sheetrat | e5262279d070cd7819c9a36db326ba0ba2eac104ce56217c20a697bd7872a027

Analysis

user interaction
yes
max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Client.exe
Size 558KB
Sample260821-katn2abj21
SHA256 e5262279d070cd7819c9a36db326ba0ba2eac104ce56217c20a697bd7872a027
MD5 1fcb5cab101011f6cb16ca72c64f2002
SHA1 144a7a3913dd35186de749e2c21878c048af34f1
SHA512 5132faa50db5144c94c2266cc5ecc49c2e05505a7758cab267ae29a13cb6bb66a0edaf6fe70dcf553659f19db2632e1cd77553c5f9b7c004eb39539fa0219168
SSDEEP 12288:TrO5eS1MXhPIypuzuPVle8YyXwUfvOCbAxqZA:TryMxPIUuzAXVvrhi
TLSH
T16CC4D40CFE91F804CD1A3D77CFEA15004B7165C1AF1196822269AFFD8B663B259E267C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_yjhknzvoolzsh defense_evasion execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_yjhknzvoolzsh

dasdasdadfs-60695.portmap.host:60695

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/3904-0-0x0000000000BC0000-0x0000000000C52000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral1/memory/3904-0-0x0000000000BC0000-0x0000000000C52000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdSnagit.exe"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\a5as1gjc.5lu.exe\""	a5as1gjc.5lu.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 7 IoCs

pid	Process
4608	xdwdSnagit.exe
5028	a5as1gjc.5lu.exe
1040	a5as1gjc.5lu.exe
3624	a5as1gjc.5lu.exe
3396	a5as1gjc.5lu.exe
3500	a5as1gjc.5lu.exe
780	a5as1gjc.5lu.exe

Loads dropped DLL 64 IoCs

pid	Process
3308	Process not Found
2980	Process not Found
2612	Process not Found
4608	xdwdSnagit.exe
3356	Process not Found
1764	Process not Found
2004	Process not Found
1040	WmiApSrv.exe
4720	Process not Found
4132	Process not Found
3980	Process not Found
872	Process not Found
1384	Process not Found
3364	Process not Found
4172	Process not Found
4228	Process not Found
3156	Process not Found
1772	Process not Found
4036	Process not Found
2452	Process not Found
2896	Process not Found
764	Process not Found
2476	Process not Found
4632	Process not Found
4240	Process not Found
3304	powershell.exe
4856	Process not Found
5028	a5as1gjc.5lu.exe
4144	Process not Found
768	Process not Found
4896	Process not Found
4852	Process not Found
4580	Process not Found
2980	Process not Found
2304	Process not Found
4512	taskkill.exe
2380	Process not Found
4112	Process not Found
1208	Process not Found
2624	Process not Found
1220	Process not Found
2424	Process not Found
1872	Process not Found
1476	Process not Found
544	Process not Found
412	Process not Found
4268	Process not Found
3364	Process not Found
5016	Process not Found
1040	a5as1gjc.5lu.exe
3624	a5as1gjc.5lu.exe
3396	a5as1gjc.5lu.exe
3500	a5as1gjc.5lu.exe
780	a5as1gjc.5lu.exe
1344	Process not Found
4844	Process not Found
3764	Process not Found
3012	Process not Found
4412	Process not Found
1084	Process not Found
4624	Process not Found
3872	Process not Found
1980	Process not Found
2580	Process not Found

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\a5as1gjc.5lu.exe\" -startup"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\a5as1gjc.5lu.exe\" --init"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\a5as1gjc.5lu.exe\" /setup"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\a5as1gjc.5lu.exe\""	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\a5as1gjc.5lu.exe\" --wininit"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	a5as1gjc.5lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	a5as1gjc.5lu.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
3304	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1508	cmd.exe
956	cmd.exe
4432	cmd.exe
4380	cmd.exe
3268	cmd.exe
628	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3516	CMD.exe
1572	cmd.exe
2756	CMD.exe
744	CMD.exe
4324	CMD.exe
1468	CMD.exe
4724	CMD.exe
3604	CMD.exe
4860	CMD.exe
4356	CMD.exe
1396	CMD.exe
4580	CMD.exe
2792	CMD.exe
4660	CMD.exe
8	CMD.exe
2920	CMD.exe
312	CMD.exe
3412	CMD.exe
4424	CMD.exe
4696	CMD.exe
212	CMD.exe
3064	CMD.exe
3972	CMD.exe
2336	CMD.exe
3352	CMD.exe
4548	CMD.exe
1696	CMD.exe
1032	CMD.exe
3876	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4512	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2744	schtasks.exe
3872	schtasks.exe
3204	schtasks.exe
4760	schtasks.exe
2368	schtasks.exe
3700	schtasks.exe
3228	schtasks.exe
728	schtasks.exe
4624	schtasks.exe
5048	schtasks.exe
4268	schtasks.exe
1308	schtasks.exe
2000	schtasks.exe
5048	schtasks.exe
628	schtasks.exe
2452	schtasks.exe
972	schtasks.exe
1444	schtasks.exe
3872	schtasks.exe
5048	schtasks.exe
1504	schtasks.exe
1280	schtasks.exe
3568	schtasks.exe
3672	schtasks.exe
656	schtasks.exe
3696	schtasks.exe
2984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
3904	Client.exe
1040	WmiApSrv.exe
1040	WmiApSrv.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
5028	a5as1gjc.5lu.exe
5028	a5as1gjc.5lu.exe
5028	a5as1gjc.5lu.exe
5028	a5as1gjc.5lu.exe
4512	taskkill.exe
4512	taskkill.exe
1040	a5as1gjc.5lu.exe
1040	a5as1gjc.5lu.exe
3624	a5as1gjc.5lu.exe
3624	a5as1gjc.5lu.exe
3396	a5as1gjc.5lu.exe
3396	a5as1gjc.5lu.exe
3500	a5as1gjc.5lu.exe
3500	a5as1gjc.5lu.exe
780	a5as1gjc.5lu.exe
780	a5as1gjc.5lu.exe
1476	shutdown.exe
1476	shutdown.exe
2736	LogonUI.exe
2736	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	Client.exe
Token: SeDebugPrivilege	4608	xdwdSnagit.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	5028	a5as1gjc.5lu.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeShutdownPrivilege	1476	shutdown.exe
Token: SeRemoteShutdownPrivilege	1476	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 1696	3904	Client.exe	94
PID 1696 wrote to memory of 5048	1696	CMD.exe	96
PID 3904 wrote to memory of 3972	3904	Client.exe	97
PID 3972 wrote to memory of 1280	3972	CMD.exe	99
PID 3904 wrote to memory of 3412	3904	Client.exe	100
PID 3412 wrote to memory of 3872	3412	CMD.exe	102
PID 3904 wrote to memory of 2336	3904	Client.exe	108
PID 2336 wrote to memory of 728	2336	CMD.exe	110
PID 3904 wrote to memory of 4424	3904	Client.exe	113
PID 4424 wrote to memory of 628	4424	CMD.exe	115
PID 3904 wrote to memory of 4696	3904	Client.exe	117
PID 4696 wrote to memory of 2452	4696	CMD.exe	119
PID 3904 wrote to memory of 3516	3904	Client.exe	120
PID 3516 wrote to memory of 3204	3516	CMD.exe	122
PID 4608 wrote to memory of 1468	4608	xdwdSnagit.exe	124
PID 1468 wrote to memory of 3568	1468	CMD.exe	126
PID 3904 wrote to memory of 4356	3904	Client.exe	127
PID 4356 wrote to memory of 972	4356	CMD.exe	129
PID 4608 wrote to memory of 1032	4608	xdwdSnagit.exe	130
PID 1032 wrote to memory of 4760	1032	CMD.exe	132
PID 3904 wrote to memory of 8	3904	Client.exe	133
PID 8 wrote to memory of 2368	8	CMD.exe	135
PID 3904 wrote to memory of 4724	3904	Client.exe	136
PID 4724 wrote to memory of 4624	4724	CMD.exe	138
PID 3904 wrote to memory of 212	3904	Client.exe	139
PID 212 wrote to memory of 5048	212	CMD.exe	141
PID 3904 wrote to memory of 1396	3904	Client.exe	142
PID 1396 wrote to memory of 2744	1396	CMD.exe	144
PID 3904 wrote to memory of 4324	3904	Client.exe	145
PID 4324 wrote to memory of 1444	4324	CMD.exe	147
PID 3904 wrote to memory of 3064	3904	Client.exe	148
PID 3064 wrote to memory of 3872	3064	CMD.exe	150
PID 3904 wrote to memory of 1572	3904	Client.exe	153
PID 1572 wrote to memory of 3304	1572	cmd.exe	155
PID 3904 wrote to memory of 2920	3904	Client.exe	156
PID 2920 wrote to memory of 4268	2920	CMD.exe	158
PID 3304 wrote to memory of 5028	3304	powershell.exe	159
PID 5028 wrote to memory of 628	5028	a5as1gjc.5lu.exe	160
PID 5028 wrote to memory of 3268	5028	a5as1gjc.5lu.exe	161
PID 5028 wrote to memory of 4380	5028	a5as1gjc.5lu.exe	162
PID 5028 wrote to memory of 4432	5028	a5as1gjc.5lu.exe	163
PID 5028 wrote to memory of 956	5028	a5as1gjc.5lu.exe	164
PID 5028 wrote to memory of 1508	5028	a5as1gjc.5lu.exe	165
PID 5028 wrote to memory of 4512	5028	a5as1gjc.5lu.exe	166
PID 4380 wrote to memory of 3276	4380	cmd.exe	174
PID 4380 wrote to memory of 4332	4380	cmd.exe	175
PID 1508 wrote to memory of 1832	1508	cmd.exe	198
PID 628 wrote to memory of 4816	628	cmd.exe	177
PID 956 wrote to memory of 2896	956	cmd.exe	178
PID 4432 wrote to memory of 1364	4432	cmd.exe	179
PID 3268 wrote to memory of 4364	3268	cmd.exe	192
PID 1508 wrote to memory of 4928	1508	cmd.exe	194
PID 956 wrote to memory of 2756	956	cmd.exe	204
PID 4432 wrote to memory of 3672	4432	cmd.exe	197
PID 628 wrote to memory of 1832	628	cmd.exe	198
PID 3268 wrote to memory of 2072	3268	cmd.exe	199
PID 3904 wrote to memory of 2756	3904	Client.exe	204
PID 2756 wrote to memory of 3700	2756	CMD.exe	206
PID 3904 wrote to memory of 3352	3904	Client.exe	207
PID 3352 wrote to memory of 3672	3352	CMD.exe	209
PID 3904 wrote to memory of 4580	3904	Client.exe	210
PID 4580 wrote to memory of 656	4580	CMD.exe	212
PID 3904 wrote to memory of 4548	3904	Client.exe	213
PID 4548 wrote to memory of 5048	4548	CMD.exe	215

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4364	attrib.exe
2756	attrib.exe
4928	attrib.exe
1832	attrib.exe
2072	attrib.exe
3276	attrib.exe
1832	attrib.exe
4816	attrib.exe
3672	attrib.exe
4332	attrib.exe
2896	attrib.exe
1364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Node.js" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Node.js" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Lightroom" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Cortana.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Lightroom" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Cortana.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe"'
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке группировки "CMEPTHiKi" и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнки) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 12 часов с момента запуска чтобы ввести код 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:628
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:4816
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:1832
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке группировки "CMEPTHiKi" и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнки) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 12 часов с момента запуска чтобы ввести код 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3268
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:4364
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:2072
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке группировки "CMEPTHiKi" и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнки) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 12 часов с момента запуска чтобы ввести код 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4380
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:3276
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:4332
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке группировки "CMEPTHiKi" и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнки) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 12 часов с момента запуска чтобы ввести код 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4432
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:1364
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:3672
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке группировки "CMEPTHiKi" и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнки) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 12 часов с момента запуска чтобы ввести код 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:956
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:2896
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:2756
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке группировки "CMEPTHiKi" и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнки) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 12 часов с момента запуска чтобы ввести код 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1508
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:1832
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:4928
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill.exe /im Explorer.exe /f
        5⤵
        Loads dropped DLL
        Kills process with taskkill
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1308
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Executes a command shell one-liner
  PID:3876
- - C:\Windows\system32\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1476

C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe
C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3568
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1040

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe" -startup
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1040

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe" /setup
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe" --init
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe" --wininit
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\a5as1gjc.5lu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:780

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3908055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ol2njih4.bba.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ol2njih4.bba.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AddSelect.DVR

Path C:\Users\Admin\Desktop\AddSelect.DVR
Size 424KB
SHA256 a0c48aec4d9d9075bae44f4dc89efd5b8f1d1f64a4ff51d51b74ccb617a20628
MD5 ebfe59893d444eb03013b9b846c121cb
SHA1 bd0fef15ac1153ad3c168af131be84de959ef525
SHA512 06cb7ec16737d47e665a8ce4df8e535446a85288f86339c87f9b9a5615791d26afd3f5a6ca63e014b4818b23427a895797ab34d78919c85be9d1b9bf0b3a87c6
SSDEEP 6144:OcseHHzgkyW1GoWDQDN1yn952Xx5adiEDnDLQzuUJlQkMB3LVA44NXOfsqf:OWTPN/ynH2hqZLQzLJutnA1XWsw
TLSH
T111942388013F14AA31F920A159E3CB6399BACC092F3EF7E54791D962DD6F035270F999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertWrite.jpeg

Path C:\Users\Admin\Desktop\AssertWrite.jpeg
Size 594KB
SHA256 d92efdb009b29e0cd3d8cf41955e5382d61c7d74f3159bf787555c343322ddad
MD5 44fd2f6bebd3e7560b924a0ab15ec3e6
SHA1 31566c0793c68a5da116100a4e8ac9111e261257
SHA512 04a0e1497f109b8fd2dd2c7f544526d3b2e4c582c2ef42239d0d022b69de90bdf451f86fd1b6f11ccf75552eff44cf47958964ac2ab19cbffeb63d8167e11ca5
SSDEEP 12288:BlM+6uIpdvdvq2lJ+ovKuHNCUG6ReFqUZSU97VUIM0h:BlM+6uqvhq2lJdKutTBvISUJc4
TLSH
T112D4230BF0E8CF3EB8ED885D0D5CEED02243F5A84D279969661D2FD11E6D5A3C04AA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectOpen.raw

Path C:\Users\Admin\Desktop\ConnectOpen.raw
Size 517KB
SHA256 2ef2c158796c330cb740016286ae69d884db85bb25ace2be03d80f92f9c77d86
MD5 1ff3ca23c767505d9340cf00eeb27f0f
SHA1 89b398468ff10329aa403652d1b8496efb31f4be
SHA512 33638afd6417a6bb45c4225552e24660ae57810d4bbc1d173aa9061ca6d310ab5dbc0fe7f0707f4e3a20650f0ca94ed035a3d9a0e87feb19f004cd440e68e6fe
SSDEEP 12288:vwtYM1tZSKs6+NKFZtBSIYnKEYwNIaasdEYEe:vwaMHZR1ntcIYnHw9e
TLSH
T191B42313A482DB69ECC9DD07B3959771A763010DF764354CC0EF3C2399173EEAAA6429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectSearch.potm

Path C:\Users\Admin\Desktop\ConnectSearch.potm
Size 502KB
SHA256 f6e8e5ad782a282c9ee27d117b168f5c69a03baa156af1da01af95d6cdcc5f94
MD5 027651187b9ac3fc478a7bcea29854b2
SHA1 0f122e6d8cdee6d56e7d566f3fe3610ac605f074
SHA512 845f52f6bb2f748e372ffde2712bf0023ca9b56bfd61fb86b8bfa65a4b148228be655f2fd0953c6155e243eec879983c732fa0f6e533198754f394c6f2f4ddca
SSDEEP 12288:m6o1bVxbwER63Iiv5Rmuo6QzfgNSBwapu+dD8KzSFMIgiueP2Phr7FxiK:mx3l6YUXmRz2SBlHdAKzYM7iueOPhr+K
TLSH
T151B4238EBAF99221F47A9A0DBF92B0A0F5351750197513224FEF81D906CF60DB4BA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToCopy.xlsx

Path C:\Users\Admin\Desktop\ConvertToCopy.xlsx
Size 12KB
SHA256 129fb4b8581fea866d4790852ab9f5f33cc527194a402f4c6f79c758e07b4877
MD5 047866d820587f9a03682785e0894817
SHA1 363f87c02d23d6ed3ae88af569fd172832c59d5e
SHA512 fdfdfe0ab0b343ed1966b3f7245cc481c1aed2991717cfe70ec98cbf1f5ddfc112140de38a6b886093cab9c655645b16c1e5ba334d2ac46e3f59e28e71510121
SSDEEP 192:wc8mVztLYFLHlEb3UfLX4a2JyZZZiaFUlbVvevUqzQXpS0NQvOPoNYW9VmuaoY:wc3fLYF+30LHPdzUlM9z6pVhpWmuaoY
TLSH
T1D5428E69E5388918E325443EC09E41E4755E11814B5B698A3D12F25BE3C02AF23FF1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyCompare.xml

Path C:\Users\Admin\Desktop\CopyCompare.xml
Size 301KB
SHA256 f30440434d50c0b2e9a45b5f97d8e756396d181c5a14618815c2629d47934079
MD5 9b18005ab91527f840aca532e45b4e07
SHA1 e7a6d53c5aae7d9872dcd4a42b94b04da21db4a5
SHA512 8f334d52c965ade15b5f5417cd5c282ff5a1d87c01cbc086db177f9eb7e202c255c4d3ce3c723fcaaae6bca9139f69f96669314b5994e13d7ffa57ac11affb5b
SSDEEP 6144:zgCtrAWgaPGxlAcrhypzTg2tBZ4FWk+2D4XO66AI+FxhiLDCa4BgyQ2Oubvt:znU+UXWzTJu8X3DhHkLDCa4BgVM
TLSH
T1106423234942CFB0B54202C72067F6D3A1453B052A99232EFC5DBDE65BAB9047F5AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyReset.xls

Path C:\Users\Admin\Desktop\CopyReset.xls
Size 563KB
SHA256 8fbcb99c081d0b16c862b9016c57c34b9a32aa36908eb8f7eb92471c245bbdb5
MD5 495cae1bbcd8cf3073e0ca2679f552b7
SHA1 4f86c15e8d34a8143070650b30b4a2491dbc98b4
SHA512 52cd85ba480db36bddf4b67f02b46f75e60d6f877e6e4e46cd9cd6e2c09019977257fa6966046e8afccc0e782ba1a154ed3cf187e7de7d90427b5fb221eff3c8
SSDEEP 12288:cgiyvNWSfsdrGgfSTiGtm6oMBpFzIU4MQ9vJB7DZC483T5FI9:cnyrgkiGtm3MBp9IUoNb704QlK9
TLSH
T15CC4231BEB684029CE6044D71CB564C0F6913DDEDBFDB186960E323936CF0B65A78A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectExpand.TS

Path C:\Users\Admin\Desktop\DisconnectExpand.TS
Size 378KB
SHA256 457ffb1e63f413e3e2bc1567c02552ddcc6d10c471f52036f7eea1b396adc2bd
MD5 23afc7522de76bb51b24a20f31a936e0
SHA1 2b2936ef81db77b72db5762d16fcef18d9568d19
SHA512 b29f5e73f090c31023ed32380c838be8d5fd4b5a6d13eb3eea8b3169c959e7444e8850271383012cb977c33f137baee68d617213c182c58f375b0a5caac639a9
SSDEEP 6144:/Nt7G/jR/Arsuy6Ou8k/lgUDb1XVG0oIIk2nrX8tcnUJbTVrTf0/pY4kLrwbs7+i:/NtOBAbj/dgKBVnofk2rXyFThyY4kLrL
TLSH
T1148423B8D6572A3217A6F97644C28C93ABDFC5BEBE1870024835D6330DBDE857A74843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandRepair.wav

Path C:\Users\Admin\Desktop\ExpandRepair.wav
Size 394KB
SHA256 13c1e5cb3007b91e8f54fddd4b4e77d44e11e26f07df4a45d0bc58e14217383d
MD5 052682a6db615b49074601492f87c7ac
SHA1 38421996c3a5d8363aba113aebc6178ad00ee6a2
SHA512 a7f2bc56ab34a92dbde9467805063a9ed5bdff0254f155e15b55a39f71ab53951a54ff577b4f423a71e0c6c6f3a28acdaf3d83d63994fbfcaa80493c3fae9a34
SSDEEP 12288:4jrOaSkZW3xu30Q7EkBO2gf7WxW4wbW9mwRDPcj:qZcdkRU7WxWnbqRE
TLSH
T1798423BBD9FD0808674B92911EE17E3B79043A57F6418A051F3A67D04F2B4AB6C2379C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindUnpublish.search-ms

Path C:\Users\Admin\Desktop\FindUnpublish.search-ms
Size 239KB
SHA256 19735655d70d92209b2a0943749dd2e981c2db2ce114b48eeb2d2f38d7292c40
MD5 118abd0c17830ce1c21585046a484617
SHA1 498014d660c38adfd0c3b68b57abf7ddf8dc9af7
SHA512 394ca2676b714f33a5f4e2f5c95e442f15eb677d069018ca3e23ffd14da2d4ead37f630b7ee62bda4f18f0cb47679e3d4e523c44f2cb22ff27d84b5755dc3098
SSDEEP 3072:7giqTsJ2vl7Dj6uWzcgdPdQsVajzH4l7tew7tjvt/LbZXWYV8xSAydvm:Ks2vlHjSwgBCPP4VMwJ7n4UAsu
TLSH
T12D34239D7769C88A81DB31F60CA8918B3CAF175DDC65AE088963174F37BD43B90839D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallRequest.docx

Path C:\Users\Admin\Desktop\InstallRequest.docx
Size 363KB
SHA256 6af5d48371cbd33157a46f69d7ab1c7f6934c0ef0e5cc834fb26580a5abca1ce
MD5 b4f84fe01fbe5496ec5840ef5a5f1e0a
SHA1 1ad524c75367c9fe13093c4ef25cba8318a7a0a2
SHA512 510e814a0a6428968b7a74078d8b207ecc39011d916727055d7f623edb6a4097ce613054459e03cfd6be199e6ab04dda0175c5a6b2db87adda7ba02fd52f3f67
SSDEEP 6144:GPdG5dj4s3BDsnYVBkzKZlaUzKtQsV7CLCmS9zt25rOOdiK/V+/9FyUMFBUW:GdG5R4s3BIpz4DzKtQU+I9zM5KOB/k/O
TLSH
T168842351EC631A15A4B642640FD6CBC63AE62580174B33ED480B635392776AF63EBA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeUpdate.rle

Path C:\Users\Admin\Desktop\InvokeUpdate.rle
Size 347KB
SHA256 c7c5c4ce27d4a3c5d7f2bef8cf0ea801895ca5a8bcbced3318345e13c794cd85
MD5 eda32783e6ce8d0fbda0e1450acae543
SHA1 29743080996c87519a7e9ac681ced5207f660914
SHA512 70539e6c2c7104e4144370227a2acb05612ae25780ba1b9497a85a3be7654c94689eb05373d7ddb3738ac61aaeb780537330c150f1ff3e712e11324cfdce2cdf
SSDEEP 6144:t4B+mwXQ7zCu2z8Hq9MxbOMURNUDeJOYd/nliWRN79QTZS1TFMWKolyxCwX:W+WGuIMxbOM1DOfd/nkgNYZShOtoUCC
TLSH
T121742392BB258541B288DC1DB4D7764A8F63ED4CAEA5F3D38F3908B03D161AA32D15DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinAdd.ps1

Path C:\Users\Admin\Desktop\JoinAdd.ps1
Size 285KB
SHA256 e14584adf8f544ea8353bd75fb677a62ffe03d471ec7c116466b4c2f640e6640
MD5 3dd12ca97407ba2af1933f19a4a39850
SHA1 67b55c65c8d873ceb56d4e54dfa38ecbbed206cc
SHA512 0a9c37f012c884ec10df8052858c693c1ce59aadce864fbb9e9bc78467783f6352017d0d5d2a31e2de02dac15e34b5c174a4dbaa1cca6c043a8337a38e881ae3
SSDEEP 6144:Y9MSoq93FGpdSYRwwAOJWNqjMXL229k9KHdtRnCPqSb:9qpoAYpJIqEDAQCH
TLSH
T1D45423CEE801E0CE2B6B65B0C44AF5D629438C165F34EB31EDA1CB40DC578B9B19C9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 6bfd0d1fe8ee4bb53df4b3521f24fc61f5624eac02675127cf66f0913e6fd50f
MD5 8e1053ff06e259e81d4ef558f0fe7c90
SHA1 eeb39f72e2a913f5d59daa1ccaff6bdabfab379a
SHA512 515008083d33dcdec491d51ac3f8bc3b5082632b175e1494236e5468bfadfdb8a3bf458063e808edd7cbdf9f30de4a4b1576686f1c60b1235b8543990c49d5cd
TLSH
T1F941A010ABE51729F3F69EB1A9F33622AE3BF815E5144B1E408143440C63A15D97EFB7
MD5 SHA1 SHA512 TLSH

Submit Download

PingGet.docx

Path C:\Users\Admin\Desktop\PingGet.docx
Size 455KB
SHA256 c0e54baa41e1ee57652f4a35451b4f825da2e36bbd6444eb36606b39dfe38cb3
MD5 0c83c35193fbe79aba44b89fe02b4c36
SHA1 041270031f3fce81f5269203f353b647468708d2
SHA512 721bb72f10f92e36eb75e8625cb93582a018b2535e02c48d142edf5f7a9811de85e322df21986a768abbc3561c38b5ce9f8e2e6063ab8adb16175298d9f2bf01
SSDEEP 12288:6v1cXKzrILEIASClBEveq3VVfI+XmVRW5ona:6dc6zUTASClB/4VVSTna
TLSH
T153A423103359C711EEB51251AB0593B3EB8FF9D074AE9BAB2271B359E28309C6F44E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterGrant.au3

Path C:\Users\Admin\Desktop\RegisterGrant.au3
Size 819KB
SHA256 a2ef5004edf77be241c8afc453e6724811d3e0505e22bee5ccf20ff8e012cf7d
MD5 d618701ef1934bf5474456a964c25432
SHA1 f5c964fe67e0c1a7aaddde1e045a4bad02845140
SHA512 7c0e7ab267cdd2667a1591cf2e93af0990be3cd31ae52941f86c813f40a1a36abb9ba85cc16e53c9560bcdd679a93914660e524ce8d07ceb3567f496b427a5f5
SSDEEP 12288:5gXanKGDbgq1etjTBFpuBG1qzIeg8UQb7Z0k97k2GdcYCdv2W2u8kofmon6a1bE5:AaKM2tHBTuByqjH5v9G629uEfb6a1RU
TLSH
T1E50533107816A8D74D1BC822B6967DF7BF5DFC09980A1C1D28D4B4878D3C3D9DE968C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestHide.html

Path C:\Users\Admin\Desktop\RequestHide.html
Size 409KB
SHA256 6a85f8d7185ef082099c433bb598f7235a13e30d28bd5657bddc136e2519cf9b
MD5 cf841425231e1297fafd120fbf0a20b3
SHA1 3e836435e43f57504fe86b99c754028d859c51ab
SHA512 379a71e13a606cfc6e01fba5cea1a0a0760cd8ade8696ae617481cc78d7056288414e441b0b3501c500bbfcce2cacbf569677a3e7f3a5f1633cffc5fc7bfd412
SSDEEP 6144:gzkJ9Ru82YePU07iV3WWXW55HBLZyc3gfBHWuR9ziNrEsU4qShPruE07xMqY/mgb:gG9RNqz83cclRWCzgEs9TuE0aRq+
TLSH
T1469423C1C5D2286A98441A5AB99DBAD15CFD887CDC840224EFC3FC1EF9CD39809D6ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEnter.wm

Path C:\Users\Admin\Desktop\ResetEnter.wm
Size 533KB
SHA256 9052a496783418ad1d4e5c9cbabfc4ea3e988ea8603a3bb82f1053f996ba6f91
MD5 4cfa1b4936ccd1558afa680ad289913e
SHA1 24f92e022d59449374aac7015f66deb68d702433
SHA512 10f80127a08262a5a86337b75f2c505ad6b41105e312e3eb2f5a1da83c3e9d7646fa878c5c2432e507b9e7b815f8223e21f446428750886bae0802065cf740c8
SSDEEP 12288:vcb+pXutbwbRu+9qFUYiJTgfq0IRbMTzH4z/cJV/DzFKaLTiI3:vkMXQ0x94UYiSfq0WKLb/HEaLTi0
TLSH
T193C423A2D7A14B3BD966908513C5C44FDDAECC596F6E0F84D2B0A44F2E3B521AFD04A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeRemove.png

Path C:\Users\Admin\Desktop\ResizeRemove.png
Size 486KB
SHA256 f8c3d216f55be84341fbedaa84cc946156ebd5c23aa099fd0f4293f94375d3dd
MD5 7a999aa853729569e643760fb1bb1073
SHA1 33191d1af094b5f28908becb88c0ea155e49efa4
SHA512 a3ca71629eb4c1e238d53f02f70a36bc426103fd6263db825005ef68e28e6f83b34abb441eb9540d26b439a687ae1600ce817f59464eb0a928330e155a1e462c
SSDEEP 12288:aG0LRbvRiCckjcbQAsG3pElKKRMSC0f/I9FXL:y1beRJZ3SlK6ZC0fw77
TLSH
T151B4230DCDDE79AEF4095BE5C558860DF4B931AFBA045C2766BD180FB2E4F8774A1202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveClear.xlsx

Path C:\Users\Admin\Desktop\ResolveClear.xlsx
Size 12KB
SHA256 67b2b17e4266c894286097312402fe9a8087dc662bd056a3b211fa02b1b20587
MD5 be3dbb7c937465895ba94bc8908f52b1
SHA1 98bb6455d86d0b03843db0ab0b19d2dfc625d51b
SHA512 b5ddaefbb31d0049e31c78b6c8b29de9abddf34030a2109eaf2d8cbfb90abce0c0deeaf0f45953534245571d2aca07f6936692817253b7ebb939900b53c1003d
SSDEEP 384:wc39wf3n3h3wGVMFamUlM9z6pNvFyEC4fG7dbaog:wywfR3w2mxWpbyECGG5fg
TLSH
T1D042AE6ED492553EC35B4939C05F81E2B24D2040DA463BCAFA60F21D59931B742FB1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveCompress.docx

Path C:\Users\Admin\Desktop\ResolveCompress.docx
Size 17KB
SHA256 043793626d26c131fd49dfd83a1730cc3dfea1097a5475295d08e7e927296976
MD5 35ad967aa7c23decc6b134242967ab1f
SHA1 6bea4aa0d9960d8cdf8001129c4274be74baad1c
SHA512 8e1402d17819f1b26ee8a2de55780a4560a474cd4e78d1e689512d93ac2a328727584afa54498ac570317db23f980af4b13fc9b2c379d218bb6f8895fb58b679
SSDEEP 384:at3NORsa+auJsVjQGdNxt/ZtNNmby1iIFHy+yy:ordEcixllNZYItNp
TLSH
T11D72CF7DD5139840F4168A7CD09312F5A13E82627562E98B341F9F0E421FB53AF36A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveUninstall.contact

Path C:\Users\Admin\Desktop\ResolveUninstall.contact
Size 579KB
SHA256 23c8776e6025da65199f8b471172c0a0be30cc11f34a3332b2e93974a89ff514
MD5 e49f5eed86de43ccd33fe1238668b873
SHA1 04bde389e681e702d36001a938e8f04777971f5f
SHA512 d83e1b581e9814ad2a786fd49f7f60953b912f5afbd0257ca4f12ec1c71bfef85e1c378eb5581e8fc24a61d069a18b15279f28261e4d335913bcc014a45964e6
SSDEEP 12288:CW0E/k161UF6nXikGjF7su+eLBc/cyQt3+nsN5BQ76MvidNjV5I06ChUWHVeV:CrvzgXikIsu+eLBc/VQtYsNnS0Npi06H
TLSH
T119C4235D0EEE351539482CA183B4432C6A8FC6FFE422BAB56D444ECB558FCDE907A364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeExport.html

Path C:\Users\Admin\Desktop\ResumeExport.html
Size 224KB
SHA256 91a2f8d2e95b4d94e164524c33f96cf5e480e65e55f904232b9ca42f223df79c
MD5 a74403a3bcc2cfbe2e76c081ad78169d
SHA1 bc710dc9f0604898de4b9310a509dec5b3962d41
SHA512 2491a7ab384133a0215346189814c887f389c1544881e64b0196524fd28e165798af7464b3bc81df03ca23e4441a57750b80d46694b38e6e407ce0f19f5ae05e
SSDEEP 6144:XCzZDJZwA9IHQajTaBNq2NTsZS3G8d7y3kQnj:mmyhATUqsaSWYQnj
TLSH
T19A24236F615D4E0FB3DA4124BB1F21A79DF51BBC980E0A9BD04EC12857132ECA691C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeMove.m4v

Path C:\Users\Admin\Desktop\ResumeMove.m4v
Size 270KB
SHA256 b4fb9a9774b750fe00658179132ff78169f30f49516842abdd30ea37f791f59e
MD5 6d123c9b24e9f5cbe1e5704afe801bbf
SHA1 0a8940a491bfb7f5d79c39314f8ec9dd49870e4b
SHA512 ec9fe36e01635cbbc1152f5412343fad857e9fc848aff4d4cd5e2bb4356d0799cb64c5e0687c7a28ccd512f327cb67631c006f834460b80416c7d700617553e2
SSDEEP 6144:cG+IKR2WVajTgOXZMgLqrqF+G1C8twJOuxVnu:cGXKjVQXZMgas+Gs8tl8u
TLSH
T1F944234F70FB3F4D457A027BA468E9FAD381E265BC73758019FAE28BE40250F3546169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveDebug.lnk

Path C:\Users\Admin\Desktop\SaveDebug.lnk
Size 208KB
SHA256 f40f05e975b523afb4d6847a9bf0d847c7c801e59d53e9551ea4ddc92a52837e
MD5 c276eac5754fea4204267fc8e3717db4
SHA1 1afb3f1384cea4e286d6fcad01dea418f5cb226f
SHA512 75702c92617787b8df3764a1cc8c81608ffda980a3d578fe33d7fe4e4f09bfdfb28c4ac80c1ef6101b4fc86af55620d284dda1b451909284d1c82dc3fb51be3b
SSDEEP 6144:P2AgBvgbPqFd6aSd5QOonAGmbeF+uhPD7r:+Avb2SAOqfF+uhz
TLSH
T18F24231FB821AB352D0472648D0DB7D5D3CCFAE35201A9408A1CDA64D4BD2DEED3956E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveGet.lnk

Path C:\Users\Admin\Desktop\SaveGet.lnk
Size 440KB
SHA256 2c3e4255fdaaeb2768594fc640e4de6cd757711e544e38570c23c1e08b577fd8
MD5 4b50bf10d95c2e4bbb4ddeac7d1c7eaa
SHA1 277b59039a3be4cb7bf0707ac01d016e4ca416ac
SHA512 c75ce0927a1ec3867d0f535b6576c1339d2a6cb91c42cbe9e1861df90e9ba704dd93b1e4bdea21f30e9cabf22773b2a505b5d245b65a036f3057fa03bc7f094a
SSDEEP 12288:YOI43Ag1CXdbI+gi/tbVPsuG+I+Z/0PDKU:FIic2+gqno+I+Z8L5
TLSH
T174A42366441DD9F36789B103D569A03C083511EFBFA8DA833AEFB25E607C19EBC58319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectConfirm.html

Path C:\Users\Admin\Desktop\SelectConfirm.html
Size 471KB
SHA256 f58f32bc674254811ebde0006ef0027178adb5169ab23d88d785d25ae81293ac
MD5 f43f74646cd3c0a3043b0c105c274f2d
SHA1 49280b3c3f211271acbaf68c4133df45c9de0fc0
SHA512 ecc1600d2fcd27c04e24491a272d671c12eb3f390a6291f616ccd33e2baeb6bc1d5b06d4ef995a588340dc73d39d49b84c669abc95cdab0645a89dff5f39f1e3
SSDEEP 12288:szIH/vHly6it+87Gk1jbi9cA/YvjwSFIjlT4q7ZILZ:ZvO6kvJvMO297iLZ
TLSH
T125A423BB097CF6D6E90FAFCC38EA7F35C0680D5945B6204340653EC1E989E13A5C5E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetPublish.xlsx

Path C:\Users\Admin\Desktop\SetPublish.xlsx
Size 10KB
SHA256 57e4e3ca21a9061b2749766c4106064250032747b122c421a73c10299725333f
MD5 eecbaf9780db3cc57dec3b20e58b20b5
SHA1 fe6b28c573c11a1013e8ad1673992147ff366ce6
SHA512 acac161c623a1500ed07f8d2e8f9ea4b277dff5f46b5da727f3c1114cfcd85df10fd4006f379ea55fa28613c4f9aaae948fe6021efce5ea050241fdaefb25fad
SSDEEP 192:wc8mVgoS3Cb3UR4xIoCHrqaFUlbVvevUqzQXpS0potO/kqyao8zx:wc3CD3G3VIoCLbUlM9z6pGtDqyao8l
TLSH
T11D327D2FF8705565C33384BCC1A642D2B98C61C597853ACE3D25F21E16826A7039A2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitGrant.exe

Path C:\Users\Admin\Desktop\SplitGrant.exe
Size 254KB
SHA256 e4e6221cd6309140798b15a5b624c304a12a64700e6063acf14ef596714b34dd
MD5 7cdec84aa0d593e5e4d3114656920a4e
SHA1 511be4dbe27d536e0490c86c7e1308f7e64b3636
SHA512 6788a228f6ec1843b0a8afefa1432e8f164ce5e901067ec28b699204df225ccbaf839f288960c3a997028e1fa727b6b8c4aa80b5f5cd0bb23155bc9f25336f02
SSDEEP 6144:98fgjuSra6mjgvgTq1gK5oCqTvdrs0Ht7+Vjn539FOpE:Gfk7fmWWXTvhDHtq9Z9cC
TLSH
T16A4423CA931BB3A0D4DB91C2C4A13145DE3A6963B8195B8137F37B7202F8D21D255F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopWrite.clr

Path C:\Users\Admin\Desktop\StopWrite.clr
Size 332KB
SHA256 a47e243d9bcbf5a67e0a1dbfdbe5438a2fb54b80c1ee7d2e58adbcd8a7abd1cd
MD5 c6c9136f4fc62552820a08106d12abe3
SHA1 60b3ce83816ba25ff9e4fe37db1aeca36b983d8f
SHA512 cc00c2183027c9dcbc158addaf38f03acdea2a9169e7b809cf4c1fcf75d474b521fe5175fc6526f9ba97817e8f144db35f6b684ae020d9d11c563565bb38f620
SSDEEP 6144:2QEsHW5+GrR9xXRYy4H9zUgleTjcMyAkVrqPlf2SzoGbNvH5QeOAO/L1:jlhGFXaySZgjs4PlfXzdNhQeOtp
TLSH
T11E74231BFF5C4C24B4B5CAE28DF9A1473256B96075AE06AE6F042C7D9FCE5E43981038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitUndo.docx

Path C:\Users\Admin\Desktop\SubmitUndo.docx
Size 14KB
SHA256 deace19631c7c816920d9ec01792fbd8fb17d76b02840c7c4b09e3aead3deea7
MD5 d564b2764e02a9e3f224a72ec7df93b3
SHA1 b0c35b17070a481a370554e39337f3c4ca7cba4c
SHA512 775d5e3e155d6ccef76dc7ee0a609e9643e4b8e7aaadee97a6bc7e6b95aa9ab295628301a35141b6f3ff6f1d24a10715b7cfdba2096e8041333cce0086d145a3
SSDEEP 192:CtAzH3vmIs3UuYvfVT3o/8McltqCCNxtpgoZ22NNc8xeTWNGFHBE3HTxTf:amH3uZATQkltqdNxt/ZtNNVPIFHWxTf
TLSH
T1CB62B034E51A1C21F7974B7CE07921FDE00D5051B355A88B246BA78F06AEBC6871378E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishRequest.eprtx

Path C:\Users\Admin\Desktop\UnpublishRequest.eprtx
Size 316KB
SHA256 d2ce8fae720580964a110ed524633b29b1a66a3d45e8a64ab98c01c533bc1f61
MD5 d409e0b1f8ebfb1caf06250873174084
SHA1 6ef204deb9094998ec17103881ecacfc80adee5b
SHA512 8ecf8b6fd7fd54bb9262a1626fc4d45224bd95b79e396c371d67e29b7f181dd3306cf30cb83d80405569c9be51e7ea7a57b35d0511df68efd315538275378324
SSDEEP 6144:Po2VovSPN42FrXNQsxeoVFEewfGC2zsEBDW0zb9y8iaBEy3yt7CFtxnhyOXCOY:A2Vo4BFesXV2ewfTw/9bz9EyCt7wtFXK
TLSH
T14864230A13F779DF88DC7AD411F743490EB2C9A583267B469E10293FBB95AD890560F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishResize.ADTS

Path C:\Users\Admin\Desktop\UnpublishResize.ADTS
Size 548KB
SHA256 f517441d5090e73adedfb50a1534c1e64d5d2d72cc8cedca304a91672fbe19bd
MD5 8b920769a991f070542176c159ec0b94
SHA1 a6fd03102c405eb4e5d76ec50b4fdf2c537534d3
SHA512 5b80f24a940b89db2cc417f0508092537961f1cda9d07b6109fdef97d8dab8534cc0c94e06830d203ea3c464cc69dfa86c7c74c67ae7feecfe10b4f55959cdf3
SSDEEP 12288:A2Svelx3iuG82JIdYzUiesG9uAYrdMCn4sC2Di9+2L1qS50:wmD3iu9NJsG98a8ASKR10
TLSH
T12DC4238446D71CDE64CBD8C0F8BCE5D28C62339FC2B8145ADC792A3496B72C522AF65D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 b5b103e11347e8f3d2e1a93cb9e4ab929ed4002e3f581829abd49165d29c89e1
MD5 147fa32bb208952f1e7e89270d592dd9
SHA1 a5a952c3a8b74e37731d5c91a2961b27e79797fb
SHA512 5afced27c0892ab4e7b8bf2fda9d40ffc51a080823f1fc7a0ca76fa09fc4727b69aad8531885c9a91469f8aedd3b07a7220d439549da531f290028cc61863d81
TLSH
T16341E1404BE71307F273DAF796F11962EA31BD25B2558B1E054983470962700E55CF2F
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 7f7e3f5ee0e0e2e42c9ea70698c53340096bc87a656a622b28eb3d95bb6bf4de
MD5 f4eeb6613cc2f4f818318299fe943f97
SHA1 a2b7bffa0f4d7bcf3fd1f82daae8477a136c1ea7
SHA512 836e1d9cf72527de0b786260a36778cd0f5e14d599145014202b547ca3bc52a3072b5a94a4867a88e3f02a0fa5d4fb1d6bc0db8fda5bc8e95dfe303657c430f2
TLSH
T1CD11CC000BF70656F1F781313A722B636373FE227A9A572EC54963844977214D56EF43
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 d9b9d5fc30f043b99f0d517e211d06705626472a39eff9e87f3974d25fd8d6c0
MD5 7610828dc0c5a1de73861a898bf57675
SHA1 cc72fbc0fb235c74ac8cd03632b053dc5d8cda05
SHA512 62ce08cdd342efd3abf2af2406e3526d84f383fd9e8adc7cf675f2d3a301b04bff18efd318b4cf04e2c589b0df88a0e12b932ae9b541b2b88edc0daca30b588d
TLSH
T1E541990537F91768F3E3963668333B200F7FF823E6541A1EA085934808A151459DCFBB
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 9591f86b1fb11492101cd37d5ed0c01b3ad5cf43241acc7c556c2dc83cf23552
MD5 a66cdb9b4fb15d5de6df832ecb927168
SHA1 432a7380ef991976fafa61a4b9843952cd955d37
SHA512 7a2a80e5403e6301afd5692e4bf0d2eca078f45855439fac1054769138cc14096ea1bed8eb72e191f14515e149297ba1c6fa6c6e3b799dce8232fa61ca90ef05
TLSH
T1BD11900426E22B46E3F7C5F0257212207F76F520E7D7271DC1C5A2495C38300D62EB9B
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info-Locker.txt

Path F:\info-Locker.txt
Size 579B
SHA256 03635f9c9600e5a701e189140d6fee64cda3eeee8b5b9f1f88a5d21597e081c6
MD5 3b1fa71432422c114708a79f4a147d51
SHA1 f144307b3e649725a414cfcfe0894fe8396f11e8
SHA512 220fcb567442eb804c4abaa6fe464c08c8f8c14190b66f743717699151ffe92030caedabe2aa06ab95e62ee1491fe9d4f5fd179c8c1180403eccbae252e64aab
TLSH
T1DFF0011AC46BCC4521415E84FF7C8E984EBDD97296AA776BF2294C3540D070A04A39D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3304-160-0x0000027A2A610000-0x0000027A2A632000-memory.dmp

Download

memory/3904-66-0x000000001BE80000-0x000000001BE90000-memory.dmp

Download

memory/3904-126-0x000000001C040000-0x000000001C05E000-memory.dmp

Download

memory/3904-153-0x000000001BE70000-0x000000001BE7C000-memory.dmp

Download

memory/3904-125-0x000000001BE60000-0x000000001BE6C000-memory.dmp

Download

memory/3904-124-0x000000001C3E0000-0x000000001C456000-memory.dmp

Download

memory/3904-0-0x0000000000BC0000-0x0000000000C52000-memory.dmp

Download

memory/3904-177-0x000000001C680000-0x000000001C688000-memory.dmp

Download

memory/5028-165-0x00000000005B0000-0x00000000005EC000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads