Analysis
- max time kernel
1s - max time network
3s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 12:54
General
- Target SwissArmySuite.exe
- Size 8.4MB
- Sample260820-p5pqsaxeld
- SHA256 bf73c67869db2375cc4e01202ad26edd9300eb00bf3fedd0f20c86848f32986c
Malware Config
Extracted
-
asyncrat
-
Default
-
https://api.telegram.org/bot7044437613:AAEXeS1SKGTrEjQ8F-7vSegWo8OLABeJY5k/sendMessage?chat_id=6052812018
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Async RAT payload 1 IoCs
- Detect Neshta payload 64 IoCs
- StormKitty payload 3 IoCs
- Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 12 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Drops file in Windows directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 11 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Modifies registry class 6 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SwissArmySuite.exe"C:\Users\Admin\AppData\Local\Temp\SwissArmySuite.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LET.EXE"C:\Users\Admin\AppData\Local\Temp\LET.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\SWISSARMYSUITE.EXE"C:\Users\Admin\AppData\Local\Temp\SWISSARMYSUITE.EXE"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LET.EXE"C:\Users\Admin\AppData\Local\Temp\LET.EXE"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SWISSARMYSUITE.EXE"C:\Users\Admin\AppData\Local\Temp\SWISSARMYSUITE.EXE"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All8⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"8⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE9⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All10⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile11⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid11⤵
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"6⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"8⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE9⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"10⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE11⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"8⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE9⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"10⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE11⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"12⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE13⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All14⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile15⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All15⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid14⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid15⤵
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"10⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE11⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"12⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE13⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"14⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE15⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"12⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE13⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"14⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE15⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"16⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE17⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"14⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE15⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"16⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE17⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"18⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE19⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All20⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile21⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All21⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid21⤵
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"16⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE17⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"18⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE19⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"20⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE21⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"18⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE19⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"20⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE21⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"22⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE23⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"20⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE21⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"22⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE23⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"24⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE25⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All26⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile27⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All27⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid27⤵
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"22⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE23⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"24⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE25⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"26⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE27⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"24⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE25⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"26⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE27⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"28⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE29⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"26⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE27⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"28⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE29⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"30⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE31⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"28⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE29⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"30⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE31⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"32⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE33⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"30⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE31⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"32⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE33⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"34⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE35⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"32⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE33⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"34⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE35⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"36⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE37⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"34⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE35⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"36⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE37⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"38⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE39⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"36⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE37⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"38⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE39⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"40⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE41⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"38⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE39⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"40⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE41⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE43⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"40⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE41⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE43⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"44⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE45⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE43⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"44⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE45⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE47⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"44⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE45⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE47⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE49⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE47⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE49⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE51⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE49⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE51⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE53⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE51⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE53⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"54⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE55⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE53⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"54⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE55⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"54⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE55⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ACROBR~1.EXE
ADOBEC~1.EXE
ADelRCP.exe
RdrCEF.exe
AcroRd32.exe
Eula.exe
FULLTR~1.EXE
READER~1.EXE
arh.exe
64BITM~1.EXE
Process.txt
Process.txt
Process.txt
Bookmarks.txt
Process.txt
Bookmarks.txt
Desktop.jpg
LET.EXE
LET.EXE
places.raw
tmp50FB.tmp.dat
tmp50FD.tmp.dat
tmp511A.tmp.dat
tmp511E.tmp.dat
tmp51AC.tmp.dat
tmp51AD.tmp.dat
tmp51BE.tmp.dat
desktop.ini
Process.txt
Process.txt
Desktop.txt
Documents.txt
Downloads.txt
OneDrive.txt
Pictures.txt
Startup.txt
Temp.txt
Videos.txt
desktop.ini
desktop.ini
desktop.ini
desktop.ini
desktop.ini
directx.sys
directx.sys
directx.sys
directx.sys
svchost.com
memory/224-414-0x0000000000400000-0x000000000041B000-memory.dmp
memory/316-104-0x0000000000400000-0x000000000041B000-memory.dmp
memory/628-117-0x0000000000400000-0x000000000041B000-memory.dmp
memory/724-103-0x0000000000400000-0x000000000041B000-memory.dmp
memory/800-274-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1040-447-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1120-45-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1124-74-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1184-415-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1332-36-0x0000000004D20000-0x0000000004D86000-memory.dmp
memory/1332-21-0x0000000000440000-0x0000000000472000-memory.dmp
memory/1412-461-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1456-308-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1500-463-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1580-46-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1728-331-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1944-358-0x0000000005F50000-0x00000000064F4000-memory.dmp
memory/1944-359-0x0000000005A80000-0x0000000005B12000-memory.dmp
memory/2404-196-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2444-176-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2524-47-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2616-224-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2676-930-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2676-411-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2944-374-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3104-412-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3160-454-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3180-338-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3192-462-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3232-409-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3308-928-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3308-410-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3344-392-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3412-1112-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3504-116-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3584-160-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3904-264-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3948-76-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3964-75-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3968-86-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4056-115-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4084-431-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4088-339-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4184-439-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4224-195-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4272-432-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4316-464-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4320-352-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4332-373-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4360-362-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4364-381-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4440-440-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4540-221-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4648-446-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4728-330-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4768-351-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4792-187-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4908-361-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4940-65-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4948-455-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4984-298-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5044-826-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5124-1079-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5340-1078-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5700-884-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5768-908-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5776-932-0x0000000000400000-0x000000000041B000-memory.dmp
memory/6096-974-0x0000000000400000-0x000000000041B000-memory.dmp