sheetrat | e5262279d070cd7819c9a36db326ba0ba2eac104ce56217c20a697bd7872a027

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 558KB
Sample260821-katn2abj21
SHA256 e5262279d070cd7819c9a36db326ba0ba2eac104ce56217c20a697bd7872a027
MD5 1fcb5cab101011f6cb16ca72c64f2002
SHA1 144a7a3913dd35186de749e2c21878c048af34f1
SHA512 5132faa50db5144c94c2266cc5ecc49c2e05505a7758cab267ae29a13cb6bb66a0edaf6fe70dcf553659f19db2632e1cd77553c5f9b7c004eb39539fa0219168
SSDEEP 12288:TrO5eS1MXhPIypuzuPVle8YyXwUfvOCbAxqZA:TryMxPIUuzAXVvrhi
TLSH
T16CC4D40CFE91F804CD1A3D77CFEA15004B7165C1AF1196822269AFFD8B663B259E267C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_yjhknzvoolzsh defense_evasion discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_yjhknzvoolzsh

dasdasdadfs-60695.portmap.host:60695

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4948-213-0x00000000019D0000-0x00000000019DA000-memory.dmp	disable_win_def

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4948-0-0x0000000000FE0000-0x0000000001072000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/4948-0-0x0000000000FE0000-0x0000000001072000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdSnagit.exe"	Client.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2772	xdwdSnagit.exe

Loads dropped DLL 64 IoCs

pid	Process
5252	Process not Found
5780	Process not Found
5708	Process not Found
852	Process not Found
1496	Process not Found
4452	Process not Found
2352	Process not Found
5812	WmiApSrv.exe
4496	Process not Found
4604	Process not Found
2772	xdwdSnagit.exe
2520	Process not Found
2168	Process not Found
1596	Process not Found
4940	Process not Found
1904	Process not Found
5888	Process not Found
4660	Process not Found
3852	Process not Found
1492	Process not Found
1964	Process not Found
4492	Process not Found
3132	Process not Found
3084	Process not Found
5920	Process not Found
5728	Process not Found
1016	Process not Found
4776	Process not Found
124	Process not Found
1116	Process not Found
2520	Process not Found
5632	Process not Found
5660	Process not Found
1668	Process not Found
1596	Process not Found
4080	Process not Found
2768	Process not Found
356	msedge.exe
1840	msedge.exe
5992	msedge.exe
3332	msedge.exe
1988	msedge.exe
1100	msedge.exe
1188	msedge.exe
1044	msedge.exe
4200	elevation_service.exe
5596	Process not Found
4564	Process not Found
3892	msedge.exe
5824	msedge.exe
676	msedge.exe
4572	msedge.exe
4220	Process not Found
3132	Process not Found
6068	msedge.exe
4332	svchost.exe
6720	Process not Found
6176	msedge.exe
6700	msedge.exe
7000	elevation_service.exe
6936	msedge.exe
4824	Process not Found
4752	Process not Found
1020	Process not Found

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6176_827601479\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\as\messages.json	msedge.exe
File created	C:\Windows\xdwd.dll	Client.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1036399625\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1927318237\_locales\is\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 45 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2856	CMD.exe
2700	CMD.exe
4712	CMD.exe
4800	CMD.exe
1360	CMD.exe
3708	CMD.exe
5784	CMD.exe
2524	CMD.exe
3108	CMD.exe
6276	CMD.exe
4576	CMD.exe
3376	CMD.exe
1832	CMD.exe
3804	CMD.exe
2756	CMD.exe
4316	CMD.exe
6132	CMD.exe
2852	CMD.exe
5776	CMD.exe
4516	CMD.exe
4724	CMD.exe
5340	CMD.exe
3940	CMD.exe
836	CMD.exe
5108	CMD.exe
3100	CMD.exe
3924	CMD.exe
4864	CMD.exe
6712	CMD.exe
3488	CMD.exe
3232	CMD.exe
6592	CMD.exe
6120	CMD.exe
248	CMD.exe
5040	CMD.exe
4812	CMD.exe
6164	CMD.exe
6340	CMD.exe
3616	CMD.exe
4976	CMD.exe
3216	CMD.exe
4212	CMD.exe
832	CMD.exe
2336	CMD.exe
2580	CMD.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1044	msedge.exe
6936	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317743771141484"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{693CA211-6C17-4099-8E93-D85F79505A7F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{A8CC5C3D-3773-4679-82E0-53D205818F15}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4856	schtasks.exe
2792	schtasks.exe
1384	schtasks.exe
1500	schtasks.exe
6072	schtasks.exe
3212	schtasks.exe
3116	schtasks.exe
4620	schtasks.exe
4328	schtasks.exe
5612	schtasks.exe
5472	schtasks.exe
4376	schtasks.exe
5988	schtasks.exe
4256	schtasks.exe
1988	schtasks.exe
5900	schtasks.exe
2168	schtasks.exe
564	schtasks.exe
5796	schtasks.exe
1684	schtasks.exe
4196	schtasks.exe
2556	schtasks.exe
3352	schtasks.exe
4668	schtasks.exe
3788	schtasks.exe
1208	schtasks.exe
4540	schtasks.exe
7008	schtasks.exe
940	schtasks.exe
5920	schtasks.exe
6620	schtasks.exe
1628	schtasks.exe
5636	schtasks.exe
5132	schtasks.exe
3332	schtasks.exe
4760	schtasks.exe
5424	schtasks.exe
2128	schtasks.exe
2424	schtasks.exe
5168	schtasks.exe
4820	schtasks.exe
4972	schtasks.exe
3952	schtasks.exe
5624	schtasks.exe
5776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
4948	Client.exe
5812	WmiApSrv.exe
5812	WmiApSrv.exe
356	msedge.exe
356	msedge.exe
1840	msedge.exe
1840	msedge.exe
5992	msedge.exe
5992	msedge.exe
3332	msedge.exe
3332	msedge.exe
1988	msedge.exe
1988	msedge.exe
1100	msedge.exe
1100	msedge.exe
1188	msedge.exe
1188	msedge.exe
1044	msedge.exe
1044	msedge.exe
4200	elevation_service.exe
4200	elevation_service.exe
3892	msedge.exe
3892	msedge.exe
5824	msedge.exe
5824	msedge.exe
676	msedge.exe
676	msedge.exe
4572	msedge.exe
4572	msedge.exe
6068	msedge.exe
6068	msedge.exe
4332	svchost.exe
4332	svchost.exe
6176	msedge.exe
6176	msedge.exe
6700	msedge.exe
6700	msedge.exe
7000	elevation_service.exe
7000	elevation_service.exe
6936	msedge.exe
6936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	Client.exe
Token: SeDebugPrivilege	2772	xdwdSnagit.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
356	msedge.exe
356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 5108	4948	Client.exe	90
PID 5108 wrote to memory of 6072	5108	CMD.exe	92
PID 4948 wrote to memory of 832	4948	Client.exe	93
PID 832 wrote to memory of 3332	832	CMD.exe	95
PID 4948 wrote to memory of 2336	4948	Client.exe	96
PID 2336 wrote to memory of 5776	2336	CMD.exe	98
PID 4948 wrote to memory of 4724	4948	Client.exe	103
PID 4724 wrote to memory of 1628	4724	CMD.exe	105
PID 4948 wrote to memory of 3100	4948	Client.exe	106
PID 3100 wrote to memory of 564	3100	CMD.exe	108
PID 4948 wrote to memory of 2756	4948	Client.exe	112
PID 2756 wrote to memory of 5796	2756	CMD.exe	114
PID 4948 wrote to memory of 4576	4948	Client.exe	116
PID 4576 wrote to memory of 4760	4576	CMD.exe	118
PID 4948 wrote to memory of 6120	4948	Client.exe	119
PID 6120 wrote to memory of 3212	6120	CMD.exe	121
PID 4948 wrote to memory of 4316	4948	Client.exe	122
PID 4316 wrote to memory of 5636	4316	CMD.exe	124
PID 4948 wrote to memory of 248	4948	Client.exe	125
PID 248 wrote to memory of 4820	248	CMD.exe	127
PID 4948 wrote to memory of 6132	4948	Client.exe	128
PID 6132 wrote to memory of 4856	6132	CMD.exe	130
PID 2772 wrote to memory of 3708	2772	xdwdSnagit.exe	131
PID 3708 wrote to memory of 4972	3708	CMD.exe	133
PID 4948 wrote to memory of 2580	4948	Client.exe	134
PID 2580 wrote to memory of 4668	2580	CMD.exe	136
PID 2772 wrote to memory of 4976	2772	xdwdSnagit.exe	137
PID 4976 wrote to memory of 1500	4976	CMD.exe	139
PID 4948 wrote to memory of 2856	4948	Client.exe	140
PID 2856 wrote to memory of 3116	2856	CMD.exe	142
PID 4948 wrote to memory of 5784	4948	Client.exe	143
PID 5784 wrote to memory of 5472	5784	CMD.exe	145
PID 4948 wrote to memory of 5340	4948	Client.exe	146
PID 5340 wrote to memory of 4620	5340	CMD.exe	148
PID 4948 wrote to memory of 2700	4948	Client.exe	149
PID 2700 wrote to memory of 3952	2700	CMD.exe	151
PID 4948 wrote to memory of 5040	4948	Client.exe	152
PID 5040 wrote to memory of 3788	5040	CMD.exe	154
PID 4948 wrote to memory of 4812	4948	Client.exe	155
PID 4812 wrote to memory of 2792	4812	CMD.exe	157
PID 4948 wrote to memory of 2852	4948	Client.exe	158
PID 2852 wrote to memory of 5424	2852	CMD.exe	160
PID 4948 wrote to memory of 3924	4948	Client.exe	161
PID 3924 wrote to memory of 1684	3924	CMD.exe	163
PID 4948 wrote to memory of 5776	4948	Client.exe	164
PID 5776 wrote to memory of 4328	5776	CMD.exe	166
PID 4948 wrote to memory of 4712	4948	Client.exe	167
PID 4712 wrote to memory of 4196	4712	CMD.exe	169
PID 4948 wrote to memory of 4800	4948	Client.exe	170
PID 4800 wrote to memory of 1208	4800	CMD.exe	172
PID 4948 wrote to memory of 3940	4948	Client.exe	173
PID 3940 wrote to memory of 2556	3940	CMD.exe	175
PID 4948 wrote to memory of 2524	4948	Client.exe	176
PID 2524 wrote to memory of 5900	2524	CMD.exe	178
PID 4948 wrote to memory of 3216	4948	Client.exe	179
PID 3216 wrote to memory of 2168	3216	CMD.exe	181
PID 4948 wrote to memory of 4212	4948	Client.exe	182
PID 4212 wrote to memory of 4540	4212	CMD.exe	184
PID 4948 wrote to memory of 1360	4948	Client.exe	185
PID 1360 wrote to memory of 4376	1360	CMD.exe	187
PID 4948 wrote to memory of 4516	4948	Client.exe	188
PID 4516 wrote to memory of 2128	4516	CMD.exe	190
PID 4948 wrote to memory of 3376	4948	Client.exe	191
PID 3376 wrote to memory of 1384	3376	CMD.exe	193

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Client.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Node.js" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Node.js" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Lightroom" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Cortana.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Lightroom" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Cortana.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffcf0f0c188,0x7ffcf0f0c194,0x7ffcf0f0c1a0
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15154912682085311849,17341540680345843584,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:11
    3⤵
    - Loads dropped DLL
    - System Time Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,14568668095219423237,11009591865509158191,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,14442713340261364719,2175609937402433817,262144 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,1590766252787590184,12185936217780403429,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,16710385362221013925,17276212814132064238,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,2910661129829880736,1808951456761412188,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,17136878290222056287,8879446410938780562,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4384,i,14968038105141312404,9127054238571579010,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4828,i,8175452827733484067,10386750280587931359,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4988,i,10087590317031487714,4264888002035101704,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4992,i,13031343003756948199,9013414406359388193,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5028,i,7481228552255229590,13984799723969687394,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,29876828275647924,17280552221542374642,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6152,i,11917825372060650580,6575618913600946683,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6196,i,15849351860038807206,9844514987829530042,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6228,i,12674013562083482493,1745596491844719583,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,4999797851952834093,11117090718611194331,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,4999797851952834093,11117090718611194331,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5876,i,6135438946675447702,1130498771220210218,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6244,i,4420697168628704365,12268813221784667297,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6288,i,13255082666598234247,3667230813091224871,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6304,i,4477297365447106141,8092340683090618901,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6356,i,3566582675641815079,10001952963797938313,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6332,i,2886764854915294740,15324236212925223189,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6384,i,9383107855435970509,4922307387178955630,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6412,i,9362786396919220930,11172669276020928970,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,10816665741270731263,796127618083302946,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:14
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16791496157173476161,12853559062531873293,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:14
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6472,i,1255419097072065681,4891769656424610966,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6604,i,4738743126903978987,8405835290640922930,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,1743410700262721275,9572770567268442060,524288 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6656,i,10277355104750191391,6589516883436045756,2097152 --field-trial-handle=2224,i,10082476773155096470,12715655517389574641,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x328,0x7ffcf0f0c188,0x7ffcf0f0c194,0x7ffcf0f0c1a0
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1900,i,18024418250670808273,11730914685720595565,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
      4⤵
      Loads dropped DLL
      System Time Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,2864033514392300993,4586590136895814835,262144 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2480,i,6306483236624906256,896424285600337316,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:13
      4⤵
      PID:7028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4428,i,7620281778882622185,5542953469839016558,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:6372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4428,i,7620281778882622185,5542953469839016558,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4892,i,6580791630512274310,10258102541240595672,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5040,i,18091777066231389419,10257222598963318710,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5044,i,16516049392602992599,8605575016989675555,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:6396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4856,i,2212114083396748554,7963189498152870431,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5124,i,17342438666071431289,7202727434806880699,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4744,i,1000334486371518259,14326386633832669748,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4864,i,4983613657566152155,7276017756686367616,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4984,i,16141053479628982577,18425324565601911865,524288 --field-trial-handle=2228,i,11201435087814450768,3686474618137017675,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=sheet
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6620

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5812

C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe
C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "OBS Studio Update" /tr "C:\Users\Admin\AppData\Roaming\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:7000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cd3a47cd1044d3beec0ed2e06b9ea01d73a5b193156ac2761294c0cae7dcc398
MD5 18f8705a4c1cd1e392fd25d00e4ec443
SHA1 119ba9b237f3a1afbf1ee737fc1f13f66d00c872
SHA512 a896bc1328b549a87d1b4ebf8b50d4b79e3a26bae928a85320dc60140940ac970e0076cace36b41886c4114af724fc760214c729e1678c39a14399545e5af1d6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b27d5926cfe2be0df2c3ab0a124f348c5eb253e973fc38a3ca03eaadcf7cbef3
MD5 6563ca326dd50a243300796da9d50c31
SHA1 0d4d43573b95f9d9e1c65ad2f7c92f6b32990ced
SHA512 9deb1f97d55324c2ff327bb7db10c31b75b7273615d8da5bf9406145a33357de641f2ff564e30306b3b7170c1069a35d61484c42e78e5846e9636019c596dfd0
TLSH
T13FD0A76069E9F6E1E116153D8210021071996A92AA57620BA250451D9E3E1C356D94A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cf86feadd56e6ce2fbd82eccd0a5956e66f311646085c984381c10494e8dc40b
MD5 4609396f1778710c4a68f65de25473fc
SHA1 37c72f57019a17a1bf201b298c6b462224178719
SHA512 91ee7aa3990f242d19986637c0d852e44542538e690be154038c09d88f3427602dd1cd584d2e0997893b546304ea85d7a012923f6457fe246afbc82afcc9d53e
TLSH
T164D097B066EAA810C1070039C1102225319E6A90A823620BA140020D5D3F1C2A2CC027
MD5 SHA1 SHA512 TLSH

Submit Download

10427517-3b86-485c-8008-d0d58a82bdbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10427517-3b86-485c-8008-d0d58a82bdbc.tmp
Size 414B
SHA256 8064402547ae2b57cb3bed64990d3bd9b3ce956158456cf9c9fc17c215d5d1c8
MD5 c65b614e0caa4ff77c755de433fc18fa
SHA1 474b167daea9d46ea21337615d266dd9b23ba95a
SHA512 8b9948bf6cb424ef1c526d1064de84d3b76dfa7cd1b2cdf4c80da7443f6687f79a0d044e008991ec9d3165c67c3270ce32a149b90c636e3fb4bdf42ffcf80859
TLSH
T10CE02BE9CC22EC270CFE5B2D50610747F74413572640854F7A3D9109CFB56364286C2C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1a74f30bf9d173a4a4f3baca3ff953274492550d4bfe2e082a6dd4d2d9fa6478
MD5 5c16ecc84d56fcb0d63e36bc5c106181
SHA1 1cb3edbf4daf53ff262e9683318f6f9ece92b0d8
SHA512 b7fe633b159a0f4e8a1bb0afa2c76e9d014c44c7864f97b2090ad83408e092f612c9f74c3f3cbbf4e9ec15a82d3846fab200c1282fbe9f4fa75533c7546b13f1
TLSH
T1E2513EB52B6CEBCAF72444B943E6D88B3EF8A4B906071A40C0156EF44ACAF501DD9993
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b7f1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b7f1f.TMP
Size 2KB
SHA256 7e3341131097e2d01e535489eacdf5122c26b343e402d78c2262c04dd39fb8ff
MD5 73efe32424bc52b63211c4f881b98f24
SHA1 ca0890a501939a59d6b41c0e0a31a36e64d3c383
SHA512 32167d9f8687e6ec4fdff6d1f5a04324c9f56b5d46bc506f05012388d0bd6ed5f3ff0f79b2f1f46ccdc19c0e85e751d489807d83aeb42073b204ed2d9f1b8ff2
TLSH
T1B4512CB53B6CEBCEF72444B947E6D88B3EF8A4B90A071A01C0156DF44ACAF501DD9993
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3531927b82933738423bf92836a35a1a5b941be7aabb5f865f159802df7afafb
MD5 a84aa4db2cd3285b298e9f84e744ee34
SHA1 935a260e4574d37f3fc584d8e34fb912e0e5e276
SHA512 ceccc21bbee1d569536be04a322b955a7cddf3f28759cd804e28f1fa41795400a2bd8c7ecdbd02771056d4f134d3bcf64a64bc92c9a31024be91022186e35df2
TLSH
T1F0518EF7C7E8D62D890155F4AB14AF1BCE1D1514832C3C56C9E4AE2BA3E2471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d3130fffddb4b55076eafa07e8b4a9d5443aa696040bbc3f0678d6b4e64bbb6a
MD5 69f8c9d591e68959b744299683120ee9
SHA1 e22f69119068c94a2db6534d4e57b6dca6155af5
SHA512 c9a12a38de3235425e0ac082543c9c5d0e852fee09af298b26a910af89baad36d422b4818280ee57f38a0e567799792cebeba218a9f17673859bc33a258fe8fc
SSDEEP 192:sxRtRGyM/jK1Ml86Cm/fFsaWpVt4wGizoA8pjww5/g6+WNUXNafYMMbeTqYjgmI/:sxRtgIm/fFsaWvt4pv//5zf0VYs
TLSH
T12662C816A934597B8CD7D219FA55BB93D3F91433A1D05E44AAFCDA1C00E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 82fd780373a4524ccc48a81b0d26fe474a43e97d118ffce9cb3d2de995497a2c
MD5 f374402ac00ac829f6428993050234e5
SHA1 0a8365338fc30cf26703d498eb5e4ad8862ccecf
SHA512 e486ec8c95368130bc52d0a8381286d801d8f54cce6a99f0b05894af1cb883f17056b50701fc3f73d1b7c957130a0a1dd13c98c76b5f0a7a9ee1d50f9840de5f
SSDEEP 192:sxRqRGyM/jK1Ml86Cm/fFsJYyWpVn4iZPzoA8pjww5/g6+WNUXNafYMMbeTqY8GU:sxRqgIm/fFsWyWvn4km//5zf0VZL
TLSH
T15D72D716A934597B8CDBD218FA95BF63D3F91433A1905E44A9FCDA1C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fadb4dfe2c40f721802e507195946cc133c696f9c67980d7aa97b26a1078333d
MD5 f389c1717e6549d00d693035bf067b2c
SHA1 4fef160fc3de3026eafe44dbb7bbb9dd983730fa
SHA512 78fd41b382b67433efc91dbbf4b5e54b8372333959eb1ac6ea50f571878bc52312788d0a78b87dae66d25f1e8471bf9d0b5433a24de1b441be57918d7c8d0267
SSDEEP 768:jXwHEo7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVbVuGKrockTe0Uv:jXwHEUE7gRWgs2fJ2u1jaO4GhdE7
TLSH
T11DE2FD7B680CCBBE4F4049DDEC29BD9BAD9802CB56D8CD9447FA840C03C6BEB55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8fc2ab3357edb4bfb6ce05fbd290561cafaf9ba4b697b8f50a9ccf4e894ed551
MD5 af86bdf1a071de8829b59ceee7eabc84
SHA1 db87797b39a7fc83fb8020d3568533627de48be5
SHA512 37888189db4ee20ea4b42f3479bfcfdb11219b9345a0b9a14ba472f304c4e029ff43e421e19cef0fdfe71c428853e03d8c04f236aa45cdcf147fc2c851907f1a
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHpm3zBj3TWH0ig7TK4Kg1Tc5xMv1ujS+kl:CeTieYgQxAl+eODgc1W+9M+XHpm3zBj5
TLSH
T10B915911B07B1284397E664C94A88C7F52C274F23168A92B3BB4129E5F67F139DFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e573e5d01dad1f9f6f65f73b3a3abe5475f24dbb3bf8d349f557f23832c4094a
MD5 b81f04a79d5b6bbfd311d1c0425d64de
SHA1 35068e5e3922e7014ed1311604a7dcc227b8e295
SHA512 7011bc3d2a8a27bb6eb8b0f5ba677e817e57be3009d3ecaff4afe08e5e3861c24fb74ee9d5518814742c78c7deedba86d0fa6c31741688cc68861994831b2191
SSDEEP 768:hrv+4UNbdz3T3/TBOWOiL0ONXyer1IRCzniBdeVH1SK7:hbsbV3jx0SIqn+EH1l
TLSH
T1C503BE36A4A89E338CE2A3D6B14773037FB86057C6840790E9DE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 94c96f85b21c9a0a54a799cab51dcd1166d5d324b7a5eb666e2fe66a6e45188c
MD5 cd08ca766b3dcf788ddcdeaee40de4de
SHA1 9e4d14defe8032bafbcf55cfc5d127ee15d76619
SHA512 e85ef3f252ea5758edf35f70dd791a2da0508899f25326f110b702cc35e586ad74307b5a0848d322eddd06e7c9f0624b34fbbb2d926a31485f20f1c108fc3726
SSDEEP 768:mrv+4UNbdz3iz/TBOWOiLQsONXyer1IRCzniwRleVH1SKk:mbsbV3+xBSIqnNlEH1m
TLSH
T16503BF31A0A9DE334DE2A396B14B63537FB82067C9C40B90EDDA5F4E069759D230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fb98ce5af5abfe95831863ec6a83521076b0882b5df50a08cc05f7e154e1500d
MD5 5d3935fea6d96c1a5d487a4fdb9ef283
SHA1 bff8ad663ca8958fa3cfefd2d1e63aab5410c55c
SHA512 9162a743ac318a29db5361567f6837efbb7ef1278fd3c1f13b99432f654bf24cef55f3d954424ca8dea0d9ed9f6705b214bc1b9da2ef1b8f07cfe34edb395746
SSDEEP 768:jrv+4UNbdz3uB/TBOWOiLQsONXyer1IRCzniwRleVH1SK7:jbsbV3cxBSIqnNlEH1l
TLSH
T1B003BF31E0A9DE334DE2A396B04763537FB8206789C40B90EDDA5F4E069759E270F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 04080dab292e745362afac304353c5f2d73a9a52024c31a4bd4683725f6f91d7
MD5 ba279062ba93e2a90b06597059a56ce9
SHA1 6487cfeba6e10b31f7f6557c3c228efc73001694
SHA512 5c3745359484a9dd90e85c3a47ea5d805c22e05d3e44b174673df4fdc76106fa8971532b4782b773c4c340ef178c23f573cc438d8e2b7c6fc13e9ce3593ed0d3
SSDEEP 768:0M3Bgf/TBOWOiLQsONXyer1IRCzni9Rlfsqw:0M3BgxBSIqnWlfsqw
TLSH
T141F2AE30A4A5DD234CE6E3C6B2466793AFF81077C9C89A50EDDE9F1E058355E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 da18d0a01b211dfc07aa0108cd50f48e54a5cc4e9ed0e49fc5d4f550c7da39a5
MD5 91dd98f356c175e95d78500d4db7ecdd
SHA1 eca3bde41103d149abc10ad88ff321870305d43e
SHA512 4ddd4081a9660e7aee6ebf7da275e1562820d2e1bb6e19fd8e8cf0e1904ee4ef4f72c3d16e6883065006bf6ab66d33fdd0bb0a49e1969a8ac0b924e92d9dacf6
SSDEEP 768:0Q3B/f/TBOWOiLQsONXyer1IRCzni9yZcb2+fsqw:0Q3BXxBSIqnfZu2+fsqw
TLSH
T1FA039C3CDC659D3F48ADB389324E67626EB8103BC5B88954EBD94B0E843395DF70B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d5acd06d6a282e0d2b464be22bce1eb55b3e341187cd5f7182cde2b7debb62e
MD5 615b2c014121b90e63da08c5e2c60f7b
SHA1 7487c42b6e2856be1a82c2f475e2ac359ebe92e4
SHA512 eb23a4f2de35f212aa89878d9424ad233e479197add1fd63e1bcf1e4cc685bc632d9c7cd5ec6dd0928b93b81fd3edd87e1201dd7694d83f5c8cb905819a53e86
SSDEEP 3:MsEllllkEthXllkl2zEflhTRKX:/M/xT02zeI
TLSH
T1824404447FC00C1DD5101031C053C3707374D4100513574734D14433DDC75400C10014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

7c6caa18-3259-4729-914b-9da97f611a7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\7c6caa18-3259-4729-914b-9da97f611a7b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6176_1464206669\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6176_734236663\CRX_INSTALL\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4948-149-0x00000000019A0000-0x00000000019AC000-memory.dmp

Download

memory/4948-5-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-40-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-8-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-0-0x0000000000FE0000-0x0000000001072000-memory.dmp

Download

memory/4948-7-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-130-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-148-0x000000001CCC0000-0x000000001CD36000-memory.dmp

Download

memory/4948-150-0x0000000003330000-0x000000000334E000-memory.dmp

Download

memory/4948-213-0x00000000019D0000-0x00000000019DA000-memory.dmp

Download

memory/4948-4-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-3-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-2-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/4948-229-0x00000000019E0000-0x00000000019F2000-memory.dmp

Download

memory/4948-1-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp

Download