Overview

overview

10

Static

static

10

2026-05-28...op.exe

windows10-2004-x64

10

2026-05-28...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    45s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
  • Size 2.3MB
  • Sample260528-e5xraagz4v
  • SHA256 fe688a201f98a2aa709a4da98ab9710ff31c6ad9c157a0e4385930a9d91559ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverybabylonratneshtapersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Babylon RAT payload 27 IoCs
  • Detect Neshta payload 64 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 27 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 58 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 16 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 30 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 45 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 45 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:708
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3632
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:1652
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:872
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 540
                7⤵
                • Program crash
                PID:1364
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2932
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:836
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3840
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4164
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3464
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 540
                    9⤵
                    • Program crash
                    PID:3444
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:756
              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4736
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2024
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4232
                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1556
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2500
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1780
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 512
                            13⤵
                            • Program crash
                            PID:1380
                    • C:\ProgramData\Synaptics\Synaptics.exe
                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2132
                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:5000
                        • C:\Windows\svchost.com
                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5024
                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:2564
                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:2296
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5076
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  PID:3728
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 516
                                    17⤵
                                    • Program crash
                                    PID:4304
                            • C:\ProgramData\Synaptics\Synaptics.exe
                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:4104
                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:640
                                • C:\Windows\svchost.com
                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:2348
                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:2532
                                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:2472
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4432
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2308
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 512
                                            21⤵
                                            • Program crash
                                            PID:2596
                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:3368
                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:4452
                                        • C:\Windows\svchost.com
                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                          20⤵
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4704
                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:3420
                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:4924
                                              • C:\Windows\svchost.com
                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4800
                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                  24⤵
                                                  • Executes dropped EXE
                                                  PID:4716
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 512
                                                    25⤵
                                                    • Program crash
                                                    PID:4620
                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1488
                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                23⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious use of WriteProcessMemory
                                                PID:4440
                                                • C:\Windows\svchost.com
                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1600
                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Adds Run key to start application
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4592
                                                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1660
                                                      • C:\Windows\svchost.com
                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5208
                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                          28⤵
                                                          • Executes dropped EXE
                                                          PID:5240
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 512
                                                            29⤵
                                                            • Program crash
                                                            PID:5296
                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Modifies registry class
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2516
                                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5332
                                                        • C:\Windows\svchost.com
                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5524
                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5560
                                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5636
                                                              • C:\Windows\svchost.com
                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6004
                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:6036
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 516
                                                                    33⤵
                                                                    • Program crash
                                                                    PID:840
                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:6128
                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Modifies registry class
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1696
                                                                • C:\Windows\svchost.com
                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4392
                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Adds Run key to start application
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5144
                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5384
                                                                      • C:\Windows\svchost.com
                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5452
                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5528
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 512
                                                                            37⤵
                                                                            • Program crash
                                                                            PID:5184
                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6032
                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry class
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5600
                                                                        • C:\Windows\svchost.com
                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                          36⤵
                                                                          • Drops file in Windows directory
                                                                          PID:2812
                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                            37⤵
                                                                            • Loads dropped DLL
                                                                            • Adds Run key to start application
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            PID:5168
                                                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                              38⤵
                                                                              • Drops file in Windows directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:3252
                                                                              • C:\Windows\svchost.com
                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                39⤵
                                                                                • Drops file in Windows directory
                                                                                PID:5656
                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                  40⤵
                                                                                    PID:5800
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 512
                                                                                      41⤵
                                                                                      • Program crash
                                                                                      PID:5868
                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                38⤵
                                                                                • Checks computer location settings
                                                                                • Loads dropped DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry class
                                                                                PID:6056
                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                  39⤵
                                                                                  • Checks computer location settings
                                                                                  • Drops file in Windows directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  PID:5616
                                                                                  • C:\Windows\svchost.com
                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                    40⤵
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5916
                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                      41⤵
                                                                                      • Checks computer location settings
                                                                                      • Loads dropped DLL
                                                                                      • Adds Run key to start application
                                                                                      • Modifies registry class
                                                                                      PID:5540
                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                        42⤵
                                                                                        • Checks computer location settings
                                                                                        • Drops file in Windows directory
                                                                                        • Modifies registry class
                                                                                        PID:1648
                                                                                        • C:\Windows\svchost.com
                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                          43⤵
                                                                                          • Drops file in Windows directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5176
                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                            44⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5604
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 524
                                                                                              45⤵
                                                                                              • Program crash
                                                                                              PID:6080
                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                        42⤵
                                                                                        • Checks computer location settings
                                                                                        • Loads dropped DLL
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:6028
                                                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                          43⤵
                                                                                          • Checks computer location settings
                                                                                          • Drops file in Windows directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          PID:752
                                                                                          • C:\Windows\svchost.com
                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                            44⤵
                                                                                              PID:5884
                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                45⤵
                                                                                                • Checks computer location settings
                                                                                                • Loads dropped DLL
                                                                                                • Adds Run key to start application
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies registry class
                                                                                                PID:5848
                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                  46⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Drops file in Windows directory
                                                                                                  • Modifies registry class
                                                                                                  PID:3672
                                                                                                  • C:\Windows\svchost.com
                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                    47⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:2848
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                      48⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5064
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 512
                                                                                                        49⤵
                                                                                                        • Program crash
                                                                                                        PID:5196
                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                  46⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry class
                                                                                                  PID:5756
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                    47⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Modifies registry class
                                                                                                    PID:5900
                                                                                                    • C:\Windows\svchost.com
                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                      48⤵
                                                                                                      • Drops file in Windows directory
                                                                                                      PID:5816
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                        49⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Loads dropped DLL
                                                                                                        • Adds Run key to start application
                                                                                                        PID:5644
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                          50⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Drops file in Windows directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry class
                                                                                                          PID:3188
                                                                                                          • C:\Windows\svchost.com
                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                            51⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2536
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                              52⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4720
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 512
                                                                                                                53⤵
                                                                                                                • Program crash
                                                                                                                PID:4268
                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                          50⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Loads dropped DLL
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry class
                                                                                                          PID:5692
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                            51⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Drops file in Windows directory
                                                                                                            • Modifies registry class
                                                                                                            PID:2560
                                                                                                            • C:\Windows\svchost.com
                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                              52⤵
                                                                                                                PID:5424
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                  53⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Modifies registry class
                                                                                                                  PID:5012
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                    54⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Modifies registry class
                                                                                                                    PID:2224
                                                                                                                    • C:\Windows\svchost.com
                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                      55⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5964
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                        56⤵
                                                                                                                          PID:5652
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 512
                                                                                                                            57⤵
                                                                                                                            • Program crash
                                                                                                                            PID:5828
                                                                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                      54⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Loads dropped DLL
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry class
                                                                                                                      PID:5760
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                        55⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Modifies registry class
                                                                                                                        PID:5696
                                                                                                                        • C:\Windows\svchost.com
                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                          56⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5324
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                            57⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Adds Run key to start application
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry class
                                                                                                                            PID:4060
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                              58⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Modifies registry class
                                                                                                                              PID:5456
                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                59⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:6276
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                  60⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:6316
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 512
                                                                                                                                    61⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:6384
                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                              58⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Modifies registry class
                                                                                                                              PID:6268
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                59⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Modifies registry class
                                                                                                                                PID:6456
                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                  60⤵
                                                                                                                                    PID:6572
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                      61⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:6624
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                        62⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:6760
                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                          63⤵
                                                                                                                                            PID:7096
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                              64⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:7140
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 512
                                                                                                                                                65⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:6016
                                                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                          62⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Modifies registry class
                                                                                                                                          PID:7080
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                            63⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5820
                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                              64⤵
                                                                                                                                                PID:5556
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                  65⤵
                                                                                                                                                    PID:6236
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                      66⤵
                                                                                                                                                        PID:6436
                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                          67⤵
                                                                                                                                                            PID:6492
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                              68⤵
                                                                                                                                                                PID:6556
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 512
                                                                                                                                                                  69⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:6468
                                                                                                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                            66⤵
                                                                                                                                                              PID:6968
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                67⤵
                                                                                                                                                                  PID:7076
                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                    68⤵
                                                                                                                                                                      PID:5372
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                        69⤵
                                                                                                                                                                          PID:5336
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                            70⤵
                                                                                                                                                                              PID:6176
                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                71⤵
                                                                                                                                                                                  PID:6796
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                    72⤵
                                                                                                                                                                                      PID:6824
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 512
                                                                                                                                                                                        73⤵
                                                                                                                                                                                        • Program crash
                                                                                                                                                                                        PID:6272
                                                                                                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                  70⤵
                                                                                                                                                                                    PID:6420
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                      71⤵
                                                                                                                                                                                        PID:6952
                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                          72⤵
                                                                                                                                                                                            PID:7152
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                              73⤵
                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                    PID:6368
                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                        PID:6856
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                            PID:6932
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6932 -s 512
                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                              PID:6880
                                                                                                                                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                          PID:3404
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                              PID:3888
                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                  PID:748
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                      PID:4224
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                          PID:6496
                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                              PID:6904
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 512
                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                    PID:6912
                                                                                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                PID:6812
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                    PID:3712
                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                        PID:6712
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                            PID:6216
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                PID:6788
                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                    PID:3360
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                        PID:6640
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 512
                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                          PID:6376
                                                                                                                                                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                          PID:6188
                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                              PID:6960
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                  PID:6564
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                      PID:6776
                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                          PID:6648
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 512
                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:6468
                                                                                                                                                                                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                            PID:6840
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                                PID:6744
                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                    PID:6660
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                        PID:6928
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                            PID:6736
                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                                PID:6376
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                    PID:5828
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 516
                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:4652
                                                                                                                                                                                                                                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                  PID:6464
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                      PID:6708
                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                          PID:6800
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                              PID:6992
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                  PID:6292
                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                      PID:7344
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                          PID:7396
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 512
                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                            PID:7448
                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                        PID:7352
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                                            PID:7524
                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                PID:7632
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                    PID:7684
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                        PID:7824
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                                                                                                                            PID:8164
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 512
                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  PID:7192
                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                              PID:8152
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7268
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5368
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6620
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7604
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7892
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:8000
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 512
                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                                                        PID:8124
                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:8072
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7192
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7388
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7328
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7652
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7756
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:8008
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 516
                                                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                                                                                                              PID:7424
                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:8060
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7416
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7488
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7904
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:8012
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7368
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7464
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 512
                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8044
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7804
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7860
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7668
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8028
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8108
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7376
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7376 -s 516
                                                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7264
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7308
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7472
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7888
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7912
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7340
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6240 -s 512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7360
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7272
                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:1004
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 872 -ip 872
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2232
                                                                                                                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                    C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:4060
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3464 -ip 3464
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:2680
                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:3540
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1780 -ip 1780
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:2688
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3728 -ip 3728
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2308 -ip 2308
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                            "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4716 -ip 4716
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:1660
                                                                                                                                                                                                                            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:3984
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5240 -ip 5240
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5272
                                                                                                                                                                                                                              • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6036 -ip 6036
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:6064
                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:224
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5528 -ip 5528
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5800 -ip 5800
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5532
                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5604 -ip 5604
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4020
                                                                                                                                                                                                                                      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                        PID:1496
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5064 -ip 5064
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4720 -ip 4720
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4100
                                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                            "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:5672
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5652 -ip 5652
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:2272
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6316 -ip 6316
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:6360
                                                                                                                                                                                                                                              • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:6476
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7140 -ip 7140
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5572
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6556 -ip 6556
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:6512
                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:7112
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6824 -ip 6824
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:6868
                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:6408
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6932 -ip 6932
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:6788
                                                                                                                                                                                                                                                            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:6772
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4712 -ip 4712
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:6900
                                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6640 -ip 6640
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:6884
                                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:6508
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4556 -ip 4556
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:6336
                                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:7024
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5828 -ip 5828
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                                                            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:6880
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7396 -ip 7396
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:7432
                                                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:7540
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5868 -ip 5868
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:7188
                                                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:7228
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 8000 -ip 8000
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:8060
                                                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:7108
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8008 -ip 8008
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:7320
                                                                                                                                                                                                                                                                                            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:8172
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7464 -ip 7464
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:7848
                                                                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:7468
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7376 -ip 7376
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:7992
                                                                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:7664
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6240 -ip 6240
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:7172
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:5580

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                                                                                                                Change Default File Association

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1546.001

                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                                                                                                                Change Default File Association

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1546.001

                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                ACROBR~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 328KB
                                                                                                                                                                                                                                                                                                                • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ACROTE~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 86KB
                                                                                                                                                                                                                                                                                                                • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ADOBEC~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                                                • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ADelRCP.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                                                                                                                                                                                                                                                                                                                • Size 175KB
                                                                                                                                                                                                                                                                                                                • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                RdrCEF.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                                • Size 9.4MB
                                                                                                                                                                                                                                                                                                                • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                AcroRd32.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                                                                                                                                                                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                                                                                                                                                                • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                WCCHRO~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 183KB
                                                                                                                                                                                                                                                                                                                • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Eula.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                                                                                                                                                                                                                                                                                                                • Size 131KB
                                                                                                                                                                                                                                                                                                                • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                FULLTR~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 254KB
                                                                                                                                                                                                                                                                                                                • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                LOGTRA~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 386KB
                                                                                                                                                                                                                                                                                                                • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                READER~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 92KB
                                                                                                                                                                                                                                                                                                                • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                WOW_HE~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 147KB
                                                                                                                                                                                                                                                                                                                • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                arh.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                                                                                                                                                                                                                                                                                                                • Size 125KB
                                                                                                                                                                                                                                                                                                                • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                32BITM~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 142KB
                                                                                                                                                                                                                                                                                                                • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                64BITM~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 278KB
                                                                                                                                                                                                                                                                                                                • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ADOBEA~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 454KB
                                                                                                                                                                                                                                                                                                                • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                AdobeARM.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                jaureg.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                                                                                                                                                                                                                                                                                                                • Size 555KB
                                                                                                                                                                                                                                                                                                                • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                VSTOIN~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 121KB
                                                                                                                                                                                                                                                                                                                • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                java.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                                                                                                                                                                                                                                                                                                                • Size 325KB
                                                                                                                                                                                                                                                                                                                • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                javaw.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                                                                                                                                                                                                                                                                                                                • Size 325KB
                                                                                                                                                                                                                                                                                                                • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                javaws.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                                                                                                                                                                                                                                                                                                                • Size 505KB
                                                                                                                                                                                                                                                                                                                • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                IE_TO_~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 557KB
                                                                                                                                                                                                                                                                                                                • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                COOKIE~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 161KB
                                                                                                                                                                                                                                                                                                                • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ELEVAT~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                IDENTI~1.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                setup.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
                                                                                                                                                                                                                                                                                                                • Size 6.6MB
                                                                                                                                                                                                                                                                                                                • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                msedge.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
                                                                                                                                                                                                                                                                                                                • Size 3.8MB
                                                                                                                                                                                                                                                                                                                • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ie_to_edge_stub.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
                                                                                                                                                                                                                                                                                                                • Size 562KB
                                                                                                                                                                                                                                                                                                                • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                setup.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
                                                                                                                                                                                                                                                                                                                • Size 7.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                cookie_exporter.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
                                                                                                                                                                                                                                                                                                                • Size 155KB
                                                                                                                                                                                                                                                                                                                • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                elevated_tracing_service.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
                                                                                                                                                                                                                                                                                                                • Size 3.8MB
                                                                                                                                                                                                                                                                                                                • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                elevation_service.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                identity_helper.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                                                                                                                                                                • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                msedge_proxy.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe
                                                                                                                                                                                                                                                                                                                • Size 1.5MB
                                                                                                                                                                                                                                                                                                                • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                msedge_pwa_launcher.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                • Size 3.4MB
                                                                                                                                                                                                                                                                                                                • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                notification_click_helper.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                pwahelper.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe
                                                                                                                                                                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                                                                                                                                                                • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                msedge.exe
                                                                                                                                                                                                                                                                                                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                                                                                                                                                                                                                                                                                                                • Size 4.0MB
                                                                                                                                                                                                                                                                                                                • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                RCX81AE.tmp
                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\Synaptics\RCX81AE.tmp
                                                                                                                                                                                                                                                                                                                • Size 753KB
                                                                                                                                                                                                                                                                                                                • SHA256 fad8ee5c511c7118e6260d1e4cc0eabd1028a7081a9a414405cdaa87f018acb6
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Synaptics.exe
                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                                                                                                                                                • SHA256 fe688a201f98a2aa709a4da98ab9710ff31c6ad9c157a0e4385930a9d91559ad
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ._cache_._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Size 768KB
                                                                                                                                                                                                                                                                                                                • SHA256 9a722613f807af7d7d2c108f324b728852233fc15a9eeed1906e5bbcb33f9616
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Size 1.5MB
                                                                                                                                                                                                                                                                                                                • SHA256 160e664017d807cf822652990778789272305630f0249dd649ef978e482c903c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                28695E00
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\28695E00
                                                                                                                                                                                                                                                                                                                • Size 22KB
                                                                                                                                                                                                                                                                                                                • SHA256 2ae6eff7e44c45502e7a4699880219a517177810dbd08e75409d308ec9d65d9f
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ._cache_._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Size 727KB
                                                                                                                                                                                                                                                                                                                • SHA256 cb1c1dec2980acb674da9b9cb077fda38cfc035a600f65c6fdc84cb8636eddb0
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop.exe
                                                                                                                                                                                                                                                                                                                • Size 1.5MB
                                                                                                                                                                                                                                                                                                                • SHA256 d2e9e026df4d19fa058584ed39ad7b22359a9176e32957fe4c24e55bfa9da9ad
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                vZ9wrPAV.xlsm
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\vZ9wrPAV.xlsm
                                                                                                                                                                                                                                                                                                                • Size 17KB
                                                                                                                                                                                                                                                                                                                • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                directx.sys
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                                                                                                • Size 57B
                                                                                                                                                                                                                                                                                                                • SHA256 84ba3f2b07e112efaff6ee034b84db960521db9e504a4ac77a5e8e5e988d86d9
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                directx.sys
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                                                                                                • Size 57B
                                                                                                                                                                                                                                                                                                                • SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                svchost.com
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                • Size 40KB
                                                                                                                                                                                                                                                                                                                • SHA256 71da51fd4d49fa54fb9223c18b0cf117e3ef952ad191772c01d3e4c091eae7df
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                memory/640-737-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/708-182-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/756-524-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/836-478-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/872-221-0x0000000000600000-0x00000000006BE000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1004-190-0x00007FF8418B0000-0x00007FF8418C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1004-232-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1004-184-0x00007FF8418B0000-0x00007FF8418C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1004-189-0x00007FF8418B0000-0x00007FF8418C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1004-188-0x00007FF8418B0000-0x00007FF8418C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1004-187-0x00007FF8418B0000-0x00007FF8418C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1004-259-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1488-947-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1556-592-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1600-945-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1652-480-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1780-591-0x0000000000550000-0x000000000060E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1808-949-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1808-711-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2024-521-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2132-634-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2228-841-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2228-842-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2296-701-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2308-817-0x0000000000870000-0x000000000092E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2348-739-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2472-816-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2500-605-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2532-818-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2564-712-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2688-615-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2688-628-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2788-738-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2788-723-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2932-233-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3368-844-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3420-921-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3464-495-0x0000000000560000-0x000000000061E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3472-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3472-104-0x0000000000400000-0x0000000000649000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3472-0-0x0000000002290000-0x0000000002291000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3540-506-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3540-522-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3632-234-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3728-702-0x0000000000CF0000-0x0000000000DAE000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3840-497-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3984-943-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3984-929-0x00007FF83F350000-0x00007FF83F360000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4060-379-0x0000000000400000-0x0000000000649000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4104-741-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4164-499-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4232-603-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4432-819-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4440-944-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4452-839-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4592-1015-0x0000000000400000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4704-840-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4716-862-0x0000000000420000-0x00000000004DE000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4736-520-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4800-922-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/4924-864-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/5000-630-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/5004-112-0x0000000000400000-0x0000000000649000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/5004-380-0x0000000000400000-0x0000000000649000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/5024-631-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/5076-713-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/5116-948-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/5116-604-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download