IOC Report
PAID CA2686+CA2687+CA2688.exe

PAID CA2686+CA2687+CA2688.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Local\meshuggenah\subpredicate.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\subpredicate.vbs

data

dropped

C:\Users\user\Desktop\PAID CA2686+CA2687+CA2688.exe

"C:\Users\user\Desktop\PAID CA2686+CA2687+CA2688.exe"

C:\Users\user\AppData\Local\meshuggenah\subpredicate.exe

"C:\Users\user\Desktop\PAID CA2686+CA2687+CA2688.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Users\user\Desktop\PAID CA2686+CA2687+CA2688.exe"

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Windows\SysWOW64\systray.exe

"C:\Windows\SysWOW64\systray.exe"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\subpredicate.vbs"

C:\Users\user\AppData\Local\meshuggenah\subpredicate.exe

"C:\Users\user\AppData\Local\meshuggenah\subpredicate.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Users\user\AppData\Local\meshuggenah\subpredicate.exe"

C:\Windows\SysWOW64\msdt.exe

"C:\Windows\SysWOW64\msdt.exe"

www.f6b-crxy.top/cu29/