Malware Analysis Report

2024-10-16 03:10

Sample ID 240812-hxt7zavcpe
Target 2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch
SHA256 8d797c2e404f3162c836020500b99c524deedabfc4770ee54fd9e0ea8bfd2ef4
Tags
hive credential_access defense_evasion discovery execution impact ransomware spyware stealer persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8d797c2e404f3162c836020500b99c524deedabfc4770ee54fd9e0ea8bfd2ef4

Threat Level: Known bad

The file 2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch was found to be: Known bad.

Malicious Activity Summary

hive credential_access defense_evasion discovery execution impact ransomware spyware stealer persistence

Hive

Hive family

Detects Go variant of Hive Ransomware

Credentials from Password Stores: Credentials from Web Browsers

Deletes shadow copies

Drops file in Drivers directory

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Reads user/profile data of web browsers

Drops startup file

Credentials from Password Stores: Windows Credential Manager

Enumerates connected drives

Drops desktop.ini file(s)

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Browser Information Discovery

Interacts with shadow copies

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Modifies registry class

Delays execution with timeout.exe

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-12 07:07

Signatures

Detects Go variant of Hive Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Hive family

hive

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-12 07:07

Reported

2024-08-12 07:10

Platform

win7-20240729-en

Max time kernel

149s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe"

Signatures

Hive

ransomware hive

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Deletes shadow copies

ransomware defense_evasion impact execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.ShwZ6WJy548J_h8yyu0J49jFm8hbUWIlxWShfXccchE.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9T8FF531\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XTGPLCO4\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\58RB03GZ\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\24PZRJVZ\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\winrm\0C0A\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\winrm\0411\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalN\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicN\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\StarterN\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnttd6.inf_amd64_neutral_ce587aa61510da51\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wialx003.inf_amd64_neutral_db618863f9347f9a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterN\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\es\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\Amd64\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wiaep002.inf_amd64_neutral_0a982dec66379cb0\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremiumN\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\Dism\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hpoa1ss.inf_amd64_neutral_8cae09a2238d64e0\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\IME\imekr8\dicts\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\Starter\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\agp.inf_amd64_neutral_22cdceb61fbafb43\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\EnterpriseE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bthspp.inf_amd64_neutral_1b15060bdfbd09e1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\MUI\0C0A\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\com\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_neutral_0cf7696e2236ca4e\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnok302.inf_amd64_ja-jp_708c81a8b0ad8846\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnrc002.inf_amd64_neutral_fdb6f2e252435905\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\migwiz\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_neutral_ea1c8215e52777a6\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\GroupPolicyUsers\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\zh-TW\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\LogFiles\WUDF\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Enterprise\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumN\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\circlass.inf_amd64_neutral_cf52485bed804e02\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\winrm\040C\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\002d\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\000b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumN\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0014\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\XPSViewer\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\bg-BG\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\oobe\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\catroot\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_neutral_d1563e8412461eea\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\NDF\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\com\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnkm005.inf_amd64_neutral_c03c9e328608873e\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Games\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6 C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.ShwZ6WJy548J_h8yyu0J468uUANK_PZZuEYCT2A6ijw.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01146_.WMF.ShwZ6WJy548J_h8yyu0J43NauM2RKDwVN--V08CrN14.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196364.WMF.ShwZ6WJy548J_h8yyu0J41gzDdf-3N185mTL6RTxjQE.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WITHCOMP.XML.ShwZ6WJy548J_h8yyu0J46a-bST4CPcz9kVlI9zChQQ.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files\Common Files\System\ado\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip.ShwZ6WJy548J_h8yyu0J45KCNS2wcyNwOIjkU4Yp3AU.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\RSSFeeds.css C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.ShwZ6WJy548J_h8yyu0J46J0HPOzdoJPUfpEM52IrzI.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Init.xsn C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.css.ShwZ6WJy548J_h8yyu0J43uhs058YfAjk6y_AUGnpEc.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\THMBNAIL.PNG.ShwZ6WJy548J_h8yyu0J48-V7gq5dj0icb4-zRxVX1s.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN01165_.WMF C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.PH.XML C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLR.SAM.ShwZ6WJy548J_h8yyu0J4-z6cdAzqwsQl7YQhgq9kgI.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\45.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.ShwZ6WJy548J_h8yyu0J49kxtWRROB8u4_SZ-iRehGw.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50F.GIF C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Curacao.ShwZ6WJy548J_h8yyu0J4-wPQaC_JXxbSt0rxk9K7hw.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.GIF C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll.ShwZ6WJy548J_h8yyu0J463sYHYyf1tNapsXVJYNlS8.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.ShwZ6WJy548J_h8yyu0J4-VZllAK8thrN2-3UeSi-Hg.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp.ShwZ6WJy548J_h8yyu0J4365FxpWeUVHsHFF9Es8Vjk.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.ShwZ6WJy548J_h8yyu0J49ULrcDoW9pudWR4Z7D6CSs.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\micaut.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\BCSAddin.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.XML.ShwZ6WJy548J_h8yyu0J4-RimdLlb2FdfZiienh_EzQ.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\THMBNAIL.PNG.ShwZ6WJy548J_h8yyu0J43CYtSxWj0ls-eE2RPMxTXA.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.ShwZ6WJy548J_h8yyu0J4yOM9Sc6zXJUWE-9aJQ-DWI.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0089992.WMF C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSORES.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll.ShwZ6WJy548J_h8yyu0J40WmyMHs6tZk75XrqV9GYkA.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02263_.WMF.ShwZ6WJy548J_h8yyu0J45gf6ksfnUx32OOiaLwc9VQ.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00685_.WMF.ShwZ6WJy548J_h8yyu0J44XEc0vRNIIuKi_yt93TMCA.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Prague C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.ShwZ6WJy548J_h8yyu0J4_ORhN6rPlIK9Qm2a3-7wGY.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8734fb86705288a7\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3125fd6a3924d681\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-photoviewer_31bf3856ad364e35_6.1.7601.17514_none_3a6490abe657c371\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6a299e36a85d5b1b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_it-it_227e33fb04382aa3\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-installer-sip_31bf3856ad364e35_6.1.7600.16385_none_8f24baa231f55486\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..tore-main.resources_31bf3856ad364e35_6.1.7601.17514_de-de_35a4614663a7b4fa\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_mdmetech.inf_31bf3856ad364e35_6.1.7600.16385_none_9c62e005b58d9ebb\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.1.7601.17514_none_35802f0f452f59bb\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ratings.resources_31bf3856ad364e35_8.0.7600.16385_es-es_d037c2581aa0b073\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\msil_windowsbase.resources_31bf3856ad364e35_6.1.7600.16385_es-es_60bc40423cedbf89\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-usercpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_22077c9ec2092eae\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-netwpr.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1c5c6f2d9b25af0b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_pcmcia.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2704f2b7c177fbfc\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_prnrc002.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b7033beebab86c06\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..-whitebox.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c6b7009fc64943a1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-v..skservice.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_446a057940cb5482\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_bda.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bf3a8c35a61e35fb\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00010410_31bf3856ad364e35_6.1.7600.16385_none_e5e3bc0570c2f284\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..in-gpedit.resources_31bf3856ad364e35_6.1.7600.16385_it-it_edce3777ee340f46\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..rtmonitor.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2fc20d555b85e7a6\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-0001042f_31bf3856ad364e35_6.1.7600.16385_none_082ad34395bec29a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7601.17514_none_8375605f8afb0c19\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_netfx35cdf-cdf_sql_files_31bf3856ad364e35_6.1.7600.16385_none_a203944b32daa861\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_iirsp2.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_918cd071ea809e06\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..-logagent.resources_31bf3856ad364e35_6.1.7600.16385_es-es_deeefe9da7cfa588\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..nvservice.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c9f660d22efb4b98\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-proquota.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2d7fdadc9967052b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_keyboard.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b96e0b6743553aaf\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..mostfiles.resources_31bf3856ad364e35_8.0.7600.16385_de-de_e46461da0fb83666\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-mofinstaller_31bf3856ad364e35_6.1.7600.16385_none_6e1250e34571b3f3\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.Design.resources\3.5.0.0_es_b77a5c561934e089\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f79b126d0518f4d5\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\XsdBuildTask\c9c1aec84139cedbfe3731aa316c0ad1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_et-ee_fb8ea11c9d488af6\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-rpc-ping.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0942432b28e40740\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-uiribbon.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cbf8792bf6df54c7\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-vidclip.resources_31bf3856ad364e35_6.1.7600.16385_es-es_161ef265fcdeb2b4\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-866_31bf3856ad364e35_6.1.7600.16385_none_2adda600b4e25a37\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..k-msctfui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a1fadc375bbe80e8\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_6.1.7600.16385_it-it_997c76c65575e3a0\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..ssmanager.resources_31bf3856ad364e35_6.1.7600.16385_es-es_df30ea2c57d47f4a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..ovidermof.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9cacca735c1fcead\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_en-us_625234d72032220f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\inf\TermService\040C\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\servicing\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-b..relevated.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8410814594fed146\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..ces-theme.resources_31bf3856ad364e35_6.1.7600.16385_de-de_850100436cc18a89\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\msil_system.speech.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9511f676e4656831\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2260a04d0daf0ce1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9cb6194b257cc63\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-deskmon.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a06db0f4d325aec9\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..-driver-thunking-32_31bf3856ad364e35_6.1.7600.16385_none_8043cdd7733b9536\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\1031\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..ore-other.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e9e04fcc9fefe1f5\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-powercfg.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2772236176fd0992\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\amd64_prnep00c.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_07c3f3a24fef0937\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-w..ccore-api.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d63091e39681e95\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_6.1.7600.16385_de-de_53fa798e0f569ac9\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\inf\UGatherer\0409\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\vssadmin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2000 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2116 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2116 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2116 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2116 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2792 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2792 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c hive.bat >NUL 2>NUL

C:\Windows\SysWOW64\cmd.exe

cmd /c shadow.bat >NUL 2>NUL

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C147172E2949E98174A424C0F4B15399

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\system32\MsiExec.exe

C:\Windows\system32\MsiExec.exe -Embedding AD5138FC272727C4D91722C91B2C46C7

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\hive.bat

MD5 084fc00cf61779cd2302fd4f25c6a01a
SHA1 c8f3f7e5d2c36aa21f154dce508803cdafc7feae
SHA256 6092fcdce0693ec89ba708c582a321e799dd24a5e7bc7cae65ee006f647fff70
SHA512 58128583a4825035f3add3262be08d688cc024a49006533b9d0bb810c543fb2bcd884b1bdbf8581beb347a4ff22593bc7e08284c8399d95b3e48df08e74f117c

C:\Users\Admin\AppData\Local\Temp\shadow.bat

MD5 df5552357692e0cba5e69f8fbf06abb6
SHA1 4714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256 d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512 a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\HOW_TO_DECRYPT.txt

MD5 80207d0f8ea42bdfeaf9f5c586230aca
SHA1 747481fe2b0b6d81c3b19ba62d1e49eab6a5461f
SHA256 25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131
SHA512 73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini

MD5 31f6efda8e23000ab794ed8c1d754d2d
SHA1 f286c00b78be2f024f9f0533d20b396f7a64f98f
SHA256 5f002c254f4f74cc398af003512145108f9be2dab1a0e786588a89c7abf9c352
SHA512 ac73ff3a417d355b0b54613cb5e4fbad55a43a67175dbb39924feb440792c1beaa5afc57c5901711d697325ab149242564f3bf16fcbd070671e48049c3418074

\Windows\Installer\MSIA6AB.tmp

MD5 d1f5ce6b23351677e54a245f46a9f8d2
SHA1 0d5c6749401248284767f16df92b726e727718ca
SHA256 57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512 960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

C:\Windows\Installer\MSIA832.tmp

MD5 4a843a97ae51c310b573a02ffd2a0e8e
SHA1 063fa914ccb07249123c0d5f4595935487635b20
SHA256 727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512 905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

MD5 81e7e920312d372cf57a817049ac7c76
SHA1 0a2e953f2d8ecdf984532f2d8e3c0264fc079498
SHA256 ff9a2e7fe46937b34f8e61f58df1f6108742cce58505f212e8666cb4ab7b74f9
SHA512 76530f002a84a791f1b440c1ab57138b8813dc395027e5c02002d67e9c7a72d6e448bbc2f844fd2cfb61259c37d916a6835035bdb442b45814c1d1aab4743a52

\Program Files\Microsoft Office\Office14\VISSHE.DLL

MD5 2f4759c23abcd639ac3ca7f8fa9480ac
SHA1 9a3fece585fa01b7b941e124ead0c39c8ce9bc7c
SHA256 6d66fa59407862e0fddfcb36472fe810eb308653321ca0e374ac870f9aa8cec6
SHA512 6ab14d6a8d3e9a751d68133e734cc804de2b50a7ef223d484d0f727cdfbd00d48f6e0666c3b86a0daf9ca42c0b726f6c2a088e5bb32c993748abfea7b5904ec6

C:\Windows\Installer\MSIAB41.tmp

MD5 85221b3bcba8dbe4b4a46581aa49f760
SHA1 746645c92594bfc739f77812d67cfd85f4b92474
SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

C:\Windows\Installer\MSIAC1D.tmp

MD5 33908aa43ac0aaabc06a58d51b1c2cca
SHA1 0a0d1ce3435abe2eed635481bac69e1999031291
SHA256 4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512 d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

C:\Windows\Installer\MSIAE41.tmp

MD5 ff58cd07bf4913ef899efd2dfb112553
SHA1 f14c1681de808543071602f17a6299f8b4ba2ae8
SHA256 1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA512 23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-12 07:07

Reported

2024-08-12 07:10

Platform

win10v2004-20240802-en

Max time kernel

127s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe"

Signatures

Hive

ransomware hive

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\uk-UA\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.C5dk5EKAfuwXvvS6EdFcwsgA4MaK2HQlRvXde0FORC4.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\migwiz\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_sbp2.inf_amd64_db7034ac4806cf05\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_cdrom.inf_amd64_f08f2fe1cde58aef\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_86cdf3e1f512cca1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\IMEJP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\config\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\LogFiles\LSA\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_51d6c57c66e3de87\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\DiagSvcs\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\windowstrustedrtproxy.inf_amd64_db5be14d5e02560f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\migration\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\oobe\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mtconfig.inf_amd64_fe91941ed205cd9b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\PartialConfigurations\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\Configuration\ConfigurationStatus\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_6b639ff361f628eb\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_8370fa408706074c\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_snk.inf_amd64_213eeba98cc6f2f4\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_5b6db32fd04403a3\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\scmvolume.inf_amd64_6957cfb7d6fea5c7\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_6cf8ea2249844b50\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\Volume\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\Configuration\Registration\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ja-JP\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_0f0da968c1cfce06\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\pci.inf_amd64_66614bed5c0a20d8\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0011\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\nl-NL\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\slmgr\040C\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\F12\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ScheduledTasks\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\it-IT\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\spp\tokens\legacy\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\MailContactsCalendarSync\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\de-DE\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fscontentscreener.inf_amd64_bd1517e25f3e419f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_7500cffa210c6946\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmirmdm.inf_amd64_ba5b77b7d46bc10d\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Windows\SysWOW64\MUI\0411\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_6550f790ed88c7ba\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsii64.inf_amd64_0f02175b17cd3f66\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\pcmcia.inf_amd64_cb18bba4788e47f7\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.C5dk5EKAfuwXvvS6EdFcwhU5mkBKQ0F2HObuyFlkUh8.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\AddressBook.png.C5dk5EKAfuwXvvS6EdFcwh27jOuMtlYobAxiH8HUJmg.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AttachmentPlaceholder-Dark.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\RADIAL.INF.C5dk5EKAfuwXvvS6EdFcwtsA2CAzw8B7CEekZpxrOR0.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.C5dk5EKAfuwXvvS6EdFcwvIRYVNYPaMLZKJekXmM5E4.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Onix32.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.C5dk5EKAfuwXvvS6EdFcwvaDeZymSjtTYc3PVpvTNAE.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Close.png.C5dk5EKAfuwXvvS6EdFcwlgcPb2PrRFCNbJblat4KmQ.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.C5dk5EKAfuwXvvS6EdFcwilbZjyDJfVfGub9Q5dWZRs.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png.C5dk5EKAfuwXvvS6EdFcwo_KKFt_oi40EA9efwdGlyI.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-default.svg C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\msedgeupdateres_cy.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.C5dk5EKAfuwXvvS6EdFcwiC4VWIg6IAyEWbweY_DiW4.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.C5dk5EKAfuwXvvS6EdFcwg7lhkIcOcNcd9wQ-dZLZm8.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js.C5dk5EKAfuwXvvS6EdFcwv3XXGP5DvkdJZSt1ATrelY.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.C5dk5EKAfuwXvvS6EdFcwvNcemHMB-IFGHaFFYzGp3A.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files\Windows NT\TableTextService\en-US\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\82.jpg C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js.C5dk5EKAfuwXvvS6EdFcwqzizw4MHBAgQK02Fnl9EAs.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OSF.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.C5dk5EKAfuwXvvS6EdFcwu31KSLVWfEFgMWOJzCHzhw.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ui-strings.js.C5dk5EKAfuwXvvS6EdFcwqvdXPK9KKgSIVymtEdf2Hg.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.C5dk5EKAfuwXvvS6EdFcwt6PvOx51uNSxsbMfuCQOQ0.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-20_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.C5dk5EKAfuwXvvS6EdFcwmKdLT8qk9hqmXHrjwBoAUo.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README.txt.C5dk5EKAfuwXvvS6EdFcwoIoRsra-lM49tlT6sg7Jlc.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.C5dk5EKAfuwXvvS6EdFcwrslazknyNY6HWjA47_owXU.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-200.jpg C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\info.gif C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_auditreport_18.svg C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_es.dll.C5dk5EKAfuwXvvS6EdFcwvfjQzg7NlUUL_o1h2oSDkw.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\lib\ct.sym C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.C5dk5EKAfuwXvvS6EdFcwpw7XvSTaehyk12j5L6JYBs.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.C5dk5EKAfuwXvvS6EdFcwsTu_eXQlQBFc-W54vpXG3s.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.C5dk5EKAfuwXvvS6EdFcwrAQRkmCGBFV4ZLUvILxWyY.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-400.png C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.C5dk5EKAfuwXvvS6EdFcwiVB1rH5wgNXIxqVCtX7bjw.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.C5dk5EKAfuwXvvS6EdFcwjXH_SUGW5w8wmpcwujbKC0.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_TypeTextFields_White@1x.png.C5dk5EKAfuwXvvS6EdFcwqWPCydJcm8BiNfqIemZ6gY.hive C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.1266_en-us_2349fda40e0c3826\r\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\msil_system.servicemodel.install.resources_b77a5c561934e089_10.0.19041.1_it-it_b372539d3949fc74\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..airingdll.resources_31bf3856ad364e35_10.0.19041.1_it-it_02797566dab1a781\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mmc-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_0562b2b904cc6113\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-rdbss.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_09b86040c40c8a6a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudfiles-apilibrary_31bf3856ad364e35_10.0.19041.1_none_497d7ca260151020\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.264_none_9b70177c85a8df54\r\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Resources\Themes\aero\fr-FR\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..vice-core.resources_31bf3856ad364e35_10.0.19041.1_es-es_eb31f8fea2dfe0bc\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_it-it_4f3dfceb6758f834\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-rastapi_31bf3856ad364e35_10.0.19041.1110_none_8e04ff5b636ae4fe\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_dual_net7400-x64-n650.inf_31bf3856ad364e35_10.0.19041.1_none_14d353a76e9c536e\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-rotmgr_31bf3856ad364e35_10.0.19041.746_none_0bd845a4159c1a60\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tionuxexe.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_294049800d68201d\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-c..entsnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_c4348f4f8d07e605\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-npiv.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_c74f6ea053cfbe7d\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\system.dynamic.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.19041.1_none_687f28352b92068b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-kernel_31bf3856ad364e35_10.0.19041.1_none_74fd915921441a6a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_da03973719857f50\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..riptedsandboxplugin_31bf3856ad364e35_11.0.19041.746_none_7d8d3c68f3a16325\f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ckagingom.resources_31bf3856ad364e35_10.0.19041.1_de-de_dfb715c8ef26e1db\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..emsupport.resources_31bf3856ad364e35_10.0.19041.1023_en-us_74c0b5df04b52bb8\f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_46ae64c1ca0cd8e9\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..container.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ada3ee541c0a53ea\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.19041.1_it-it_49167d51139e0e3f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_system.servicemodel.web.resources_31bf3856ad364e35_4.0.15805.0_ja-jp_fa2fe8ee29da813f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\SlickGrid\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.19041.746_none_71d74c9c052371e4\f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..communication-winrt_31bf3856ad364e35_10.0.19041.264_none_d2386109e9610491\r\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..xecutable.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_dd6236e95c9f69d1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000449_31bf3856ad364e35_10.0.19041.1_none_a0bf101f014dcac1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-p..package-managed-api_31bf3856ad364e35_10.0.19041.1202_none_00020b7d91f43625\r\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData.Resources\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_compiler.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_system.windows.inpu..pulations.resources_b77a5c561934e089_4.0.15805.0_es-es_b9e525930571e01b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.19041.1_it-it_52e3081d118b00ef\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-vmemulateddevices.resources_31bf3856ad364e35_10.0.19041.1_en-us_7217d1309a54e027\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..-shellcommon-broker_31bf3856ad364e35_10.0.19041.1151_none_c30ac589c1dad323\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..datausage.resources_31bf3856ad364e35_10.0.19041.1_de-de_037954372524597d\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-common-api_31bf3856ad364e35_10.0.19041.1_none_e90d02a70e50225c\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..appushsvc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e0fa59524d9d2fb1\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ctiveuser.resources_31bf3856ad364e35_10.0.19041.1_es-es_2731a4f9dc50a3e5\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..peeradmin.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fa6a546b4a245dee\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.207_none_8d07de31084775c6\r\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_presentationframework.aerolite_31bf3856ad364e35_4.0.15805.0_none_c25fdd6b0e2df812\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..w-capture.resources_31bf3856ad364e35_10.0.19041.1_de-de_8f0461b9464b5dfb\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-msports_31bf3856ad364e35_10.0.19041.1_none_4d62d24ec303020c\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-f..yphanimator-library_31bf3856ad364e35_10.0.19041.746_none_faa6ec755f8b9fdf\f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-network-qos-pacer_31bf3856ad364e35_10.0.19041.546_none_cb01ee53d6697641\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..emotepage.resources_31bf3856ad364e35_10.0.19041.1_de-de_c417cda3e244c81b\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\f\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-v..payloadrestrictions_31bf3856ad364e35_10.0.19041.1288_none_c59e86728dfb9a43\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_dual_netefe3e.inf_31bf3856ad364e35_10.0.19041.1_none_c67d78ba9767ae30\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_mdmcxpv6.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_817c47d0411338be\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_10.0.19041.1_none_152381bd05dadff7\HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{DA070EEA-6C79-4F4A-8576-E3E6F29285D8} C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1508 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2960 wrote to memory of 3916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\PerfLogs\HOW_TO_DECRYPT.txt

MD5 80207d0f8ea42bdfeaf9f5c586230aca
SHA1 747481fe2b0b6d81c3b19ba62d1e49eab6a5461f
SHA256 25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131
SHA512 73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini

MD5 c02ae28c356fe623f31695fb4aa0566e
SHA1 59a0900bd94f1663809a85808f817d07ad84edac
SHA256 338371ec1d547fee745430c854e6b3b3939c4e56087b8f9581bd692f0228df10
SHA512 ecd24de539a1f94a159dbd5231338b4e2bb63a1d9efc129f02930a37d081270d787a32cbbcf458f8288c78fc14938549a040ae61dad9f9ce8adcb664b3961cdb

C:\Users\Admin\AppData\Local\Temp\hive.bat

MD5 084fc00cf61779cd2302fd4f25c6a01a
SHA1 c8f3f7e5d2c36aa21f154dce508803cdafc7feae
SHA256 6092fcdce0693ec89ba708c582a321e799dd24a5e7bc7cae65ee006f647fff70
SHA512 58128583a4825035f3add3262be08d688cc024a49006533b9d0bb810c543fb2bcd884b1bdbf8581beb347a4ff22593bc7e08284c8399d95b3e48df08e74f117c

C:\Users\Admin\AppData\Local\Temp\shadow.bat

MD5 df5552357692e0cba5e69f8fbf06abb6
SHA1 4714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256 d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512 a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.C5dk5EKAfuwXvvS6EdFcwlOGydL22IJz7TE2GVB2oDE.hive

MD5 bc5614c4d544096493423b290e77aba7
SHA1 b34a4ffe594b5b0e0b22f01f46cdee06a035e057
SHA256 e13210c8e07eeb6696369bb69a712e882a663bbfa4511e5af392daa0a73e32b9
SHA512 65338198a0c094770aa2f8aa402cf5f8937a54bdfb3699b04f231f9e67356b48d6926d57367b7fbc9f84e5f7df151c3f32107fda9286a1825c32accf53fd38a6