Analysis
- max time kernel
22s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 02:44
General
- Target 2026-08-05_e0e2d038539f2bf0b0630f0a407330ae_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
- Size 364KB
- Sample260805-c8d28scd25
- SHA256 002c39991f37e5e7c2b282d9a6fcdabf2782cb39845b9092b03dc0dca82546f1
Score
10/10
Malware Config
Signatures
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Detect Neshta payload 64 IoCs
- Executes dropped EXE 64 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_e0e2d038539f2bf0b0630f0a407330ae_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e0e2d038539f2bf0b0630f0a407330ae_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-05_e0e2d038539f2bf0b0630f0a407330ae_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-05_e0e2d038539f2bf0b0630f0a407330ae_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE24⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE34⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE42⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE44⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE48⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE54⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE60⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE64⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"65⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"69⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE72⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"73⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE74⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"75⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE76⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE78⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE80⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"81⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE82⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"83⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE84⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE86⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"87⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE88⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"89⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE90⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"91⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE92⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"93⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE94⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE96⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE98⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE100⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE102⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE104⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE106⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"107⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE108⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE110⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE112⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"113⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE114⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE116⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"117⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE118⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE120⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"121⤵
- Drops file in Windows directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-