Analysis
- max time kernel
1s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 12:54
General
- Target SwissArmySuite.exe
- Size 8.4MB
- Sample260820-p5pqsaxeld
- SHA256 bf73c67869db2375cc4e01202ad26edd9300eb00bf3fedd0f20c86848f32986c
Malware Config
Extracted
-
asyncrat
-
Default
-
https://api.telegram.org/bot7044437613:AAEXeS1SKGTrEjQ8F-7vSegWo8OLABeJY5k/sendMessage?chat_id=6052812018
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Async RAT payload 1 IoCs
- Detect Neshta payload 64 IoCs
- StormKitty payload 3 IoCs
- Executes dropped EXE 3 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SwissArmySuite.exe"C:\Users\Admin\AppData\Local\Temp\SwissArmySuite.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LET.EXE"C:\Users\Admin\AppData\Local\Temp\LET.EXE"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\SWISSARMYSUITE.EXE"C:\Users\Admin\AppData\Local\Temp\SWISSARMYSUITE.EXE"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LET.EXE"C:\Users\Admin\AppData\Local\Temp\LET.EXE"3⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"4⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"7⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE8⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"9⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE10⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"7⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"9⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"11⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE12⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"9⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"11⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE12⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"13⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE14⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"11⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE12⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"13⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE14⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"15⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE16⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"13⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE14⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"15⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE16⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"17⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE18⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"15⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE16⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"17⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE18⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"19⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE20⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"17⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE18⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"19⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE20⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"21⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE22⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"19⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE20⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"21⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE22⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"23⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE24⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"21⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE22⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"23⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE24⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"25⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE26⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"23⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE24⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"25⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE26⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"27⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE28⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"25⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE26⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"27⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE28⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"29⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE30⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"27⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE28⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"29⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE30⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"31⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE32⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"29⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE30⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"31⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE32⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"33⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE34⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"31⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE32⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"33⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE34⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"35⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE36⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"33⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE34⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"35⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE36⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"37⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE38⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"35⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE36⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"37⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE38⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"39⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE40⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"37⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE38⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"39⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE40⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"41⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE42⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"39⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE40⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"41⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE42⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"43⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE44⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"41⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE42⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"43⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE44⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"45⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE46⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"43⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE44⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"45⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE46⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"47⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE48⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"45⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE46⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"47⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE48⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"49⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE50⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"47⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE48⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"49⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE50⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"51⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE52⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"49⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE50⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"51⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE52⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"53⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE54⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"51⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE52⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"53⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE54⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"55⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE56⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"53⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE54⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"55⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE56⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"57⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE58⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"55⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE56⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"57⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE58⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE"59⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\LET.EXE60⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"57⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE58⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\LET.EXE"59⤵
-
C:\Users\Admin\AppData\Local\Temp\LET.EXEC:\Users\Admin\AppData\Local\Temp\LET.EXE60⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE"59⤵
-
C:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXEC:\Users\Admin\AppData\Local\Temp\SWISSA~1.EXE60⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ACROBR~1.EXE
ACROTE~1.EXE
ADelRCP.exe
AcroRd32.exe
READER~1.EXE
java.exe
javaw.exe
javaws.exe
ie_to_edge_stub.exe
setup.exe
cookie_exporter.exe
elevation_service.exe
identity_helper.exe
msedge.exe
msedge_proxy.exe
msedge_pwa_launcher.exe
msedgewebview2.exe
notification_click_helper.exe
pwahelper.exe
setup.exe
elevation_service.exe
identity_helper.exe
msedge_pwa_launcher.exe
msedgewebview2.exe
notification_click_helper.exe
pwahelper.exe
MSEDGE~1.EXE
msedge.exe
LET.EXE
LET.EXE
Bookmarks.txt
directx.sys
directx.sys
directx.sys
svchost.com
memory/244-379-0x0000000000400000-0x000000000041B000-memory.dmp
memory/408-386-0x0000000000400000-0x000000000041B000-memory.dmp
memory/596-109-0x0000000000400000-0x000000000041B000-memory.dmp
memory/832-401-0x0000000000400000-0x000000000041B000-memory.dmp
memory/996-331-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1068-516-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1108-462-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1188-439-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1220-482-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1368-443-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1476-39-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1480-238-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1576-130-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1648-359-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1656-230-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1740-314-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1892-445-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1908-414-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1952-442-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2188-461-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2364-372-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2412-311-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2420-261-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2444-333-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2476-400-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2484-378-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2544-244-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2552-394-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2596-403-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2652-502-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2924-420-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2944-79-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3000-361-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3036-292-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3160-485-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3248-465-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3252-483-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3256-392-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3264-421-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3448-107-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3468-38-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3640-315-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4300-37-0x0000000004FF0000-0x0000000005056000-memory.dmp
memory/4300-22-0x00000000005D0000-0x0000000000602000-memory.dmp
memory/4600-330-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4700-80-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4704-503-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4828-304-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4872-293-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4928-254-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4952-393-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5004-476-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5112-222-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5232-285-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5328-510-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5392-231-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5480-262-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5516-351-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5560-91-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5692-274-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5720-423-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5832-496-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5896-250-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5960-463-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5968-108-0x0000000000400000-0x000000000041B000-memory.dmp
memory/6124-440-0x0000000006750000-0x0000000006D0A000-memory.dmp
memory/6124-441-0x0000000006270000-0x0000000006302000-memory.dmp
memory/6140-344-0x0000000000400000-0x000000000041B000-memory.dmp