sheetrat | 3cbcd57932f4423eb93753cf1b97093d6856f16ae5a4af180048bb65fb696c84

Analysis

user interaction
yes
max time kernel
599s
max time network
514s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 558KB
Sample260808-aamwdadr8x
SHA256 3cbcd57932f4423eb93753cf1b97093d6856f16ae5a4af180048bb65fb696c84
MD5 5bcd48efe4c2f984936ab7416dfc7433
SHA1 6d3c1908417e774ea6688d90c0dc8674e450a4d2
SHA512 cfa3e03006c7062728ad569c96024683e1d9ea8a3d81e5d8327e5158655f2fdc2a067337ec17edab415672201888f33f50b55a3392e2db8bd8fdaaf4db172135
SSDEEP 6144:mi0LpNUM1VCZmtWLRgF/ETfF6wwupHYVr1e4kn1fARFQmc0plorRQ/FL0EbpUHp5:mBLpNJLWIETdfXOuyBoF97DOJE
TLSH
T12FC4910CFE81F844DE1E3DB7CFE911044BB164C1AE2195922169AFFD8B6637259E227C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_tcwjcmmwqyakvk defense_evasion discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

2.7.1

Campaign

Sheet_tcwjcmmwqyakvk

91.92.47.228:1360

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/3788-0-0x0000000000220000-0x00000000002B2000-memory.dmp	family_sheetrat_v4
behavioral1/files/0x001500000001689c-5.dat	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral1/memory/3788-0-0x0000000000220000-0x00000000002B2000-memory.dmp	Sheetrat_v5
behavioral1/files/0x001500000001689c-5.dat	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\Sub\\Discord.exe"	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe"	Client.exe

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	p4swkqu4.2mv.exe

Executes dropped EXE 2 IoCs

pid	Process
2500	uqfl1ira.cqr.exe
4316	p4swkqu4.2mv.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	p4swkqu4.2mv.exe
File opened (read-only)	\??\B:	p4swkqu4.2mv.exe
File opened (read-only)	\??\J:	p4swkqu4.2mv.exe
File opened (read-only)	\??\O:	p4swkqu4.2mv.exe
File opened (read-only)	\??\P:	p4swkqu4.2mv.exe
File opened (read-only)	\??\Q:	p4swkqu4.2mv.exe
File opened (read-only)	\??\R:	p4swkqu4.2mv.exe
File opened (read-only)	\??\V:	p4swkqu4.2mv.exe
File opened (read-only)	\??\H:	p4swkqu4.2mv.exe
File opened (read-only)	\??\M:	p4swkqu4.2mv.exe
File opened (read-only)	\??\T:	p4swkqu4.2mv.exe
File opened (read-only)	\??\W:	p4swkqu4.2mv.exe
File opened (read-only)	\??\Y:	p4swkqu4.2mv.exe
File opened (read-only)	\??\Z:	p4swkqu4.2mv.exe
File opened (read-only)	\??\E:	p4swkqu4.2mv.exe
File opened (read-only)	\??\I:	p4swkqu4.2mv.exe
File opened (read-only)	\??\L:	p4swkqu4.2mv.exe
File opened (read-only)	\??\S:	p4swkqu4.2mv.exe
File opened (read-only)	\??\X:	p4swkqu4.2mv.exe
File opened (read-only)	\??\G:	p4swkqu4.2mv.exe
File opened (read-only)	\??\K:	p4swkqu4.2mv.exe
File opened (read-only)	\??\N:	p4swkqu4.2mv.exe
File opened (read-only)	\??\U:	p4swkqu4.2mv.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2336	powershell.exe
5072	powershell.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Sub\Discord.exe	Client.exe
File opened for modification	C:\Program Files\Sub\Discord.exe	Client.exe
File opened for modification	C:\Program Files\Sub	Client.exe
File opened for modification	C:\Program Files\Temp\death.mp4	p4swkqu4.2mv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	CMD.exe
4524	cmd.exe
1044	cmd.exe
4592	cmd.exe
3824	cmd.exe
3052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uqfl1ira.cqr.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5008	timeout.exe
3504	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5056	taskkill.exe
3236	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{25CEC1BA-BA51-4E2B-A188-B3C2DE9A9570}	p4swkqu4.2mv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
3788	Client.exe
2336	powershell.exe
2336	powershell.exe
2336	powershell.exe
5072	powershell.exe
5072	powershell.exe
4316	p4swkqu4.2mv.exe
4316	p4swkqu4.2mv.exe
3788	Client.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	Client.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeDebugPrivilege	4316	p4swkqu4.2mv.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeDebugPrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe
Token: SeShutdownPrivilege	4316	p4swkqu4.2mv.exe
Token: SeCreatePagefilePrivilege	4316	p4swkqu4.2mv.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 5012	3788	Client.exe	94
PID 5012 wrote to memory of 2608	5012	CMD.exe	96
PID 3788 wrote to memory of 4524	3788	Client.exe	118
PID 4524 wrote to memory of 2336	4524	cmd.exe	120
PID 2336 wrote to memory of 2500	2336	powershell.exe	121
PID 3788 wrote to memory of 1044	3788	Client.exe	124
PID 1044 wrote to memory of 5072	1044	cmd.exe	126
PID 5072 wrote to memory of 4316	5072	powershell.exe	127
PID 4316 wrote to memory of 4592	4316	p4swkqu4.2mv.exe	128
PID 4592 wrote to memory of 5056	4592	cmd.exe	130
PID 3788 wrote to memory of 3824	3788	Client.exe	131
PID 3824 wrote to memory of 1900	3824	cmd.exe	133
PID 3788 wrote to memory of 3052	3788	Client.exe	134
PID 3052 wrote to memory of 5008	3052	cmd.exe	136
PID 3052 wrote to memory of 3236	3052	cmd.exe	137
PID 3052 wrote to memory of 3504	3052	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Paint" /tr "C:\Program Files\Sub\Discord.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Paint" /tr "C:\Program Files\Sub\Discord.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uqfl1ira.cqr.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uqfl1ira.cqr.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uqfl1ira.cqr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uqfl1ira.cqr.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\p4swkqu4.2mv.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\p4swkqu4.2mv.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\p4swkqu4.2mv.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\p4swkqu4.2mv.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Enumerates connected drives
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k taskkill /f /im explorer.exe && exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4592
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "Microsoft Paint" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\schtasks.exe
    schtASks /deLeTe /F /Tn "Microsoft Paint"
    3⤵
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA66E.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    - Delays execution with timeout.exe
    PID:5008
- - C:\Windows\system32\taskkill.exe
    taskkill /im Discord.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3504

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1032

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x310 0x4b4
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Discord.exe

Path C:\Program Files\Sub\Discord.exe
Size 558KB
SHA256 3cbcd57932f4423eb93753cf1b97093d6856f16ae5a4af180048bb65fb696c84
MD5 5bcd48efe4c2f984936ab7416dfc7433
SHA1 6d3c1908417e774ea6688d90c0dc8674e450a4d2
SHA512 cfa3e03006c7062728ad569c96024683e1d9ea8a3d81e5d8327e5158655f2fdc2a067337ec17edab415672201888f33f50b55a3392e2db8bd8fdaaf4db172135
SSDEEP 6144:mi0LpNUM1VCZmtWLRgF/ETfF6wwupHYVr1e4kn1fARFQmc0plorRQ/FL0EbpUHp5:mBLpNJLWIETdfXOuyBoF97DOJE
TLSH
T12FC4910CFE81F844DE1E3DB7CFE911044BB164C1AE2195922169AFFD8B6637259E227C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

death.mp4

Path C:\Program Files\Temp\death.mp4
Size 490KB
SHA256 eb0710fc75c7f6ad85879abc03283ab5eebbfd77681fd76eda7cd9ee581d45a2
MD5 91e79e966b5a410f1c132cd04c4ddf1a
SHA1 cbbe908ed14fc325cd25bbda896ee5adc5e50b10
SHA512 67deb83fa3dc1e8e5be2b108aa51345acb2af20fce4bfd4bcf131109949b2b6ddb9303bf9025e44209ea13e0a0f3e4cf12f9bab0a39bbcc0164415cb19ed43e6
SSDEEP 12288:Hc1+5xE/PbnEWXKGr+Hb0q0Xrgk/hfS4xynpWZUsD6K:Hc8xE/P9obu1NS4xynp+x
TLSH
T1C6B41288B742A157D45982BEA1DD47A8B7F0DE41E60BD70F61E12669CFF63819E320F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 ca494d00a7aba63fc4cf7c49316bccee057616a26b917f9f12692b36b1f1dd91
MD5 24cd57a8710ead89af77751cc4ce3236
SHA1 d66a76341ec9d1f53adc3caedfbc2a78e1055a30
SHA512 903577e4d3cd91d47dbd9f4f49c48236aef013c12ed36dc8a338c23845680b709af7e5272c21f036ea88c7b6ca10d090eb2cede1d836557d8ea37d071358223f
TLSH
T16E510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 05d47b87b577841cc40db176ea634ec49b0b97066e192e1d48d84bb977e696b6
MD5 c374c25875887db7d072033f817b6ce1
SHA1 3a6d10268f30e42f973dadf044dba7497e05cdaf
SHA512 6a14f81a300695c09cb335c13155144e562c86bb0ddfdcab641eb3a168877ad3fcc0579ad86162622998928378ea2ffe5a244b3ddbe6c11a959dbb34af374a7d
SSDEEP 3:yBOXZallkltlsl7pl+e/lls4XplsMlZI1Xlldl0lcNklltlwzl4hR/mll:ykXA+1E3+e9XplskZI10cAe
TLSH
T14D539204E3609572C8048377A4EA0B83B331F0690A1EEB1B602964381C023D97CA0280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 0e43492ead4e2fb9f5473d3d770f18d0e966692a6e2d193ce70e948fda2c273e
MD5 efd5c40f678635f37dfbc7189780410e
SHA1 e164ba97778d1108834c39f5d61174aed2a62677
SHA512 4081be9843d9bc948005762be5937f630c15e61604ea7fa05993cbddd5a4a425b5ddb0917b9c78d0a14b5d442fa564bcf288be4658bdb29ce636c9afc1bb495c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_k4j5abvn.k41.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k4j5abvn.k41.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpA66E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA66E.tmp.bat
Size 192B
SHA256 9f0a95c9891c0e6f19344554e10702a6c74e1ee641801b64c2dd77e33786a2d0
MD5 5ea5df0d8e8c0e5fc6252ab0df4c6c31
SHA1 b4cb7695a04b95b85c80ce16142243f0db042f3b
SHA512 dddd726a646338b1f73cb6e24629beef158c8ac0d66525c75dde960b95d90d644f9a56dea900fa0294f4733b6659d153d959e3a407e184c21fe6044c9be6fa8d
TLSH
T1E7C0220268CBF6863A8120A102628089A34AEC0B29055761638C10083C04A6CD038B99
MD5 SHA1 SHA512 TLSH

Submit Download

p4swkqu4.2mv.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\p4swkqu4.2mv.exe
Size 1.9MB
SHA256 d7b89543b37b47d01424dfe933306e21bf9b733deee77f5e898c25506bfb4baa
MD5 8078b1e26f92709a3d685d4275da7ae8
SHA1 d448433c21261929c83e40f9d33f0706b5a88a4b
SHA512 8094fe6e5d9eb24e0c83127185d153fbdaa31cffd8c2a9afca282c6090da173c3ec62771f37fe4af8584297ffcccc5e46c7e8f3edb4532ce50b974e8f4d99ddf
SSDEEP 49152:e5zaV27sJi3gtWLExqLsY9jAaRgHuF07yp4f29sTahwXeVELC5IvmN8jqxAnOlU1:AsJi3gtWLExqLsY9jAaRgHuF07yp4f2v
TLSH
T1C2959E12334C9439D9AD437ED2E707645770CA45A452EF07359C3A699FB338AAC233BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uqfl1ira.cqr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uqfl1ira.cqr.exe
Size 1.7MB
SHA256 5ae0f54692c8f1a65cd809e2ca81a8bdd204df08281d87b8ba70f7793aa9129d
MD5 1dc19f3edc2fac159cce287e924a6001
SHA1 0c855dc8fe425ede11eb4afd31c9b20e3f43bd38
SHA512 075be96158b3aafac8935ab19bf183ce3e4873336fd42043f3409cf1e263f6f7275f050be133a88e8bfe7cb20924c5598d8a55cdbcdac383ed8b6b117bcfd560
SSDEEP 24576:QJENTf/yaueEPIq5hRljA1EDglyZHL9sGf3tlLtPJhp7J:QI61PIEUIZHLxfz37
TLSH
T1538502167908CC46DAB476F9DF81DAF913216E580A11C70335F6BF6FF9BA2034D66284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2336-1169-0x0000014A536A0000-0x0000014A536C2000-memory.dmp

Download

memory/2500-1174-0x0000000000A50000-0x0000000000BFE000-memory.dmp

Download

memory/2500-1175-0x0000000005C50000-0x00000000061F4000-memory.dmp

Download

memory/2500-1176-0x00000000055C0000-0x0000000005652000-memory.dmp

Download

memory/2500-1177-0x0000000005680000-0x000000000568A000-memory.dmp

Download

memory/3788-1154-0x0000000002430000-0x000000000244E000-memory.dmp

Download

memory/3788-0-0x0000000000220000-0x00000000002B2000-memory.dmp

Download

memory/3788-1141-0x00000000023B0000-0x00000000023BC000-memory.dmp

Download

memory/3788-1140-0x000000001BB80000-0x000000001BBF6000-memory.dmp

Download

memory/3788-131-0x0000000002360000-0x0000000002370000-memory.dmp

Download

memory/3788-32-0x0000000002360000-0x0000000002370000-memory.dmp

Download

memory/4316-1703-0x0000022601060000-0x000002260124C000-memory.dmp

Download

memory/4316-1708-0x000002261B630000-0x000002261B644000-memory.dmp

Download

memory/4316-1710-0x000002261B920000-0x000002261B978000-memory.dmp

Download