sheetrat | bc5277628f40af4d577378f8ae183ad1e056fc11c9f4857746c8b81db0a4c6ff

Analysis

user interaction
yes
max time kernel
352s
max time network
379s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
ArdorFast.exe
Size 23.0MB
Sample260905-yecg7syscv
SHA256 bc5277628f40af4d577378f8ae183ad1e056fc11c9f4857746c8b81db0a4c6ff
MD5 9aeeef3062c5eb45e7e6b22388ac1580
SHA1 fa108f01ae31185012216c776333bf69e980bb76
SHA512 5fb0df374c4389b99dbfae2bac05a6959c8f422580aa3a07f0289bf3a4e42d6820fdb6acf398da318843ee1bb7b8a10c6dd1f786a09fda1d734ed8b5ff14f11c
SSDEEP 6144:IcQCw/nHKlDVe6VlWT8b9g2qAyj3Ixe1b3mHdz:ZQwHPVle8unX36Ke1
TLSH
T19437E41CFE81E804DE1A3D77CFE610109B7121C22F219256365A6FFD8B593BA58E61BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_qwrqrmioqhvabi discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_qwrqrmioqhvabi

64.188.118.59:47663

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/1464-0-0x0000000000870000-0x00000000008C8000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral1/memory/1464-0-0x0000000000870000-0x00000000008C8000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Documents\\MATLAB.exe"	ArdorFast.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	ArdorFast.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Wireshark Host.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	b0kejusy.3wh.exe

Executes dropped EXE 7 IoCs

pid	Process
1964	MATLAB.exe
4336	zhcllsq3.5ty.exe
1448	Wireshark Host.exe
4900	MATLAB.exe
3688	b0kejusy.3wh.exe
5084	GooseDesktop.exe
4388	20ck0vbq.mt0.exe

Loads dropped DLL 64 IoCs

pid	Process
4316	Process not Found
3452	Process not Found
1964	MATLAB.exe
3844	Process not Found
3292	Process not Found
4940	Process not Found
4020	Process not Found
4212	WmiApSrv.exe
3440	Process not Found
3248	Process not Found
4924	Process not Found
2068	Process not Found
3376	Process not Found
4368	Process not Found
2852	Process not Found
1832	Process not Found
1196	Process not Found
4324	Process not Found
2960	Process not Found
3076	Process not Found
3816	Process not Found
4752	Process not Found
4704	Process not Found
4224	Process not Found
4744	Process not Found
3640	Process not Found
1940	Process not Found
3928	Process not Found
4988	Process not Found
4816	Process not Found
4804	Process not Found
3640	Process not Found
652	Process not Found
3964	Process not Found
3428	Process not Found
1836	Process not Found
1500	Process not Found
8	Process not Found
216	Process not Found
2120	Process not Found
3204	Process not Found
2004	Process not Found
4208	AUDIODG.EXE
4372	Process not Found
4788	Process not Found
1108	Process not Found
3696	Process not Found
2008	Process not Found
2124	Process not Found
1624	Process not Found
3036	Process not Found
1824	Process not Found
2368	Process not Found
4920	Process not Found
3764	Process not Found
1644	Process not Found
4984	Process not Found
116	Process not Found
4404	Process not Found
4668	Process not Found
3408	Process not Found
3980	Process not Found
1836	Process not Found
812	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
4004	powershell.exe
4344	powershell.exe
4472	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	ArdorFast.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3292	CMD.exe
1816	CMD.exe
3876	CMD.exe
648	CMD.exe
1636	CMD.exe
3336	CMD.exe
3248	CMD.exe
5116	CMD.exe
1644	CMD.exe
2264	CMD.exe
2172	CMD.exe
1940	CMD.exe
4164	CMD.exe
4832	CMD.exe
3280	CMD.exe
952	CMD.exe
4296	CMD.exe
560	CMD.exe
1544	CMD.exe
552	CMD.exe
5096	CMD.exe
4184	CMD.exe
1304	CMD.exe
3800	CMD.exe
3644	CMD.exe
224	CMD.exe
780	CMD.exe
4436	CMD.exe
1172	CMD.exe
3820	CMD.exe
4180	CMD.exe
848	CMD.exe
3700	CMD.exe
2064	CMD.exe
4464	CMD.exe
1864	CMD.exe
692	CMD.exe
3516	CMD.exe
4304	CMD.exe
1860	CMD.exe
3268	CMD.exe
2096	CMD.exe
972	CMD.exe
3180	CMD.exe
4588	CMD.exe
652	CMD.exe
664	CMD.exe
228	CMD.exe
2568	CMD.exe
2348	CMD.exe
3844	CMD.exe
440	CMD.exe
3452	CMD.exe
3540	cmd.exe
4864	CMD.exe
4228	CMD.exe
1700	CMD.exe
3152	CMD.exe
2056	CMD.exe
588	CMD.exe
364	CMD.exe
4088	CMD.exe
3784	CMD.exe
4484	CMD.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0kejusy.3wh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GooseDesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20ck0vbq.mt0.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Wireshark Host.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1276	schtasks.exe
3128	schtasks.exe
3644	schtasks.exe
512	schtasks.exe
4184	schtasks.exe
752	schtasks.exe
1000	schtasks.exe
2124	schtasks.exe
3204	schtasks.exe
1000	schtasks.exe
568	schtasks.exe
4088	schtasks.exe
3760	schtasks.exe
2492	schtasks.exe
4816	schtasks.exe
4640	schtasks.exe
4336	schtasks.exe
2244	schtasks.exe
4240	schtasks.exe
3272	schtasks.exe
3752	schtasks.exe
1280	schtasks.exe
2436	schtasks.exe
972	schtasks.exe
1976	schtasks.exe
60	schtasks.exe
2444	schtasks.exe
1444	schtasks.exe
4740	schtasks.exe
3696	schtasks.exe
4344	schtasks.exe
4480	schtasks.exe
2248	schtasks.exe
4652	schtasks.exe
456	schtasks.exe
4004	schtasks.exe
1460	schtasks.exe
4704	schtasks.exe
3980	schtasks.exe
3736	schtasks.exe
3204	schtasks.exe
824	schtasks.exe
4744	schtasks.exe
4844	schtasks.exe
2220	schtasks.exe
2444	schtasks.exe
2004	schtasks.exe
2124	schtasks.exe
3520	schtasks.exe
3872	schtasks.exe
888	schtasks.exe
2124	schtasks.exe
3104	schtasks.exe
4788	schtasks.exe
4020	schtasks.exe
1860	schtasks.exe
4736	schtasks.exe
1268	schtasks.exe
4928	schtasks.exe
4592	schtasks.exe
2124	schtasks.exe
4556	schtasks.exe
3540	schtasks.exe
4164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	MATLAB.exe
1964	MATLAB.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
4212	WmiApSrv.exe
4212	WmiApSrv.exe
4208	AUDIODG.EXE
4208	AUDIODG.EXE
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
4336	zhcllsq3.5ty.exe
4336	zhcllsq3.5ty.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe
1448	Wireshark Host.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	ArdorFast.exe
Token: SeDebugPrivilege	1964	MATLAB.exe
Token: 33	4208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4208	AUDIODG.EXE
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	1448	Wireshark Host.exe
Token: SeDebugPrivilege	4900	MATLAB.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1464	ArdorFast.exe
1464	ArdorFast.exe
1464	ArdorFast.exe
4388	20ck0vbq.mt0.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4388	20ck0vbq.mt0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 3784	1464	ArdorFast.exe	91
PID 3784 wrote to memory of 3992	3784	CMD.exe	93
PID 1464 wrote to memory of 4672	1464	ArdorFast.exe	94
PID 4672 wrote to memory of 5020	4672	CMD.exe	96
PID 1464 wrote to memory of 3280	1464	ArdorFast.exe	97
PID 3280 wrote to memory of 1996	3280	CMD.exe	99
PID 1464 wrote to memory of 396	1464	ArdorFast.exe	106
PID 396 wrote to memory of 2316	396	CMD.exe	108
PID 1464 wrote to memory of 3720	1464	ArdorFast.exe	111
PID 3720 wrote to memory of 1268	3720	CMD.exe	113
PID 1464 wrote to memory of 1544	1464	ArdorFast.exe	117
PID 1544 wrote to memory of 4984	1544	CMD.exe	119
PID 1464 wrote to memory of 764	1464	ArdorFast.exe	121
PID 764 wrote to memory of 3104	764	CMD.exe	123
PID 1464 wrote to memory of 3336	1464	ArdorFast.exe	129
PID 3336 wrote to memory of 3980	3336	CMD.exe	131
PID 1964 wrote to memory of 3292	1964	MATLAB.exe	132
PID 3292 wrote to memory of 2124	3292	CMD.exe	134
PID 1464 wrote to memory of 1212	1464	ArdorFast.exe	136
PID 1212 wrote to memory of 4020	1212	CMD.exe	138
PID 1964 wrote to memory of 4724	1964	MATLAB.exe	139
PID 4724 wrote to memory of 4164	4724	CMD.exe	141
PID 1464 wrote to memory of 3332	1464	ArdorFast.exe	142
PID 3332 wrote to memory of 3128	3332	CMD.exe	144
PID 1464 wrote to memory of 3248	1464	ArdorFast.exe	145
PID 3248 wrote to memory of 4816	3248	CMD.exe	147
PID 1464 wrote to memory of 2432	1464	ArdorFast.exe	148
PID 2432 wrote to memory of 3644	2432	CMD.exe	150
PID 1464 wrote to memory of 2676	1464	ArdorFast.exe	151
PID 2676 wrote to memory of 4640	2676	CMD.exe	153
PID 1464 wrote to memory of 440	1464	ArdorFast.exe	154
PID 440 wrote to memory of 4928	440	CMD.exe	156
PID 1464 wrote to memory of 3800	1464	ArdorFast.exe	157
PID 3800 wrote to memory of 4336	3800	CMD.exe	159
PID 1464 wrote to memory of 3180	1464	ArdorFast.exe	160
PID 3180 wrote to memory of 3896	3180	CMD.exe	162
PID 1464 wrote to memory of 3268	1464	ArdorFast.exe	163
PID 3268 wrote to memory of 972	3268	CMD.exe	165
PID 1464 wrote to memory of 552	1464	ArdorFast.exe	166
PID 552 wrote to memory of 2200	552	CMD.exe	168
PID 1464 wrote to memory of 4444	1464	ArdorFast.exe	170
PID 4444 wrote to memory of 4744	4444	CMD.exe	172
PID 1464 wrote to memory of 3068	1464	ArdorFast.exe	173
PID 3068 wrote to memory of 4368	3068	CMD.exe	175
PID 1464 wrote to memory of 1700	1464	ArdorFast.exe	176
PID 1700 wrote to memory of 636	1700	CMD.exe	178
PID 1464 wrote to memory of 4260	1464	ArdorFast.exe	179
PID 4260 wrote to memory of 4316	4260	CMD.exe	181
PID 1464 wrote to memory of 2884	1464	ArdorFast.exe	182
PID 2884 wrote to memory of 992	2884	CMD.exe	184
PID 1464 wrote to memory of 1816	1464	ArdorFast.exe	185
PID 1816 wrote to memory of 4324	1816	CMD.exe	187
PID 1464 wrote to memory of 4608	1464	ArdorFast.exe	188
PID 4608 wrote to memory of 3804	4608	CMD.exe	190
PID 1464 wrote to memory of 4256	1464	ArdorFast.exe	191
PID 4256 wrote to memory of 372	4256	CMD.exe	193
PID 1464 wrote to memory of 5036	1464	ArdorFast.exe	194
PID 5036 wrote to memory of 4820	5036	CMD.exe	196
PID 1464 wrote to memory of 3128	1464	ArdorFast.exe	197
PID 3128 wrote to memory of 4988	3128	CMD.exe	199
PID 1464 wrote to memory of 2064	1464	ArdorFast.exe	200
PID 2064 wrote to memory of 3564	2064	CMD.exe	202
PID 1464 wrote to memory of 664	1464	ArdorFast.exe	203
PID 664 wrote to memory of 456	664	CMD.exe	205

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ArdorFast.exe
"C:\Users\Admin\AppData\Local\Temp\ArdorFast.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Unity" /tr "C:\Users\Admin\Documents\MATLAB.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Unity" /tr "C:\Users\Admin\Documents\MATLAB.exe"
    3⤵
    PID:3992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe" /RL HIGHEST
    3⤵
    PID:1996
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1184
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:60
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:64
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3076
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:60
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3736
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\zhcllsq3.5ty.exe"' & exit
  2⤵
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\zhcllsq3.5ty.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\zhcllsq3.5ty.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\zhcllsq3.5ty.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4736
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4184
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\b0kejusy.3wh.exe"' & exit
  2⤵
  PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\b0kejusy.3wh.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\b0kejusy.3wh.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\b0kejusy.3wh.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\20ck0vbq.mt0.exe"' & exit
  2⤵
  PID:1068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\20ck0vbq.mt0.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\20ck0vbq.mt0.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\20ck0vbq.mt0.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /r /f /t 00
  2⤵
  - Executes a command shell one-liner
  PID:3540
- - C:\Windows\system32\shutdown.exe
    Shutdown /r /f /t 00
    3⤵
    PID:4500

C:\Users\Admin\Documents\MATLAB.exe
C:\Users\Admin\Documents\MATLAB.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2124
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4164

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4212

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x244
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3540
- C:\Users\Admin\Documents\MATLAB.exe
  "C:\Users\Admin\Documents\MATLAB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
    3⤵
    PID:4412
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4788
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3820
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4652

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa382c855 /state1:0x41c64e6d
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GooseModdingAPI.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\FOR MOD-MAKERS\GooseMod_DefaultSolution\GooseModdingAPI\obj\Release\GooseModdingAPI.dll
Size 16KB
SHA256 fba607ccfd47e2b6ba04d449f1de10e3b66ba35b7d0e96f71e7c61d0c10486f4
MD5 6f6c8f80d6c36739147b38016bd4b469
SHA1 bf0f81a00ccc595242620b15ade2a0661424d9e3
SHA512 1b3d6da8eedc140f3836c60eadc5251870d01db99e72d33ec0b2a585e2e4b2f7e643e2a12ad42f8e6d8704e8af67ca1df728acdbe18c614a1b8f6746d0c3fbc6
SSDEEP 384:nBjGRs3XVRcYEPPPr/TXRTRGYK4swkqUICTy5o:BjGe3XVRvEPPPr/TXRTRGSCTy5o
TLSH
T10A72085437E58EAFDEBB15F8A99B0105BA30F04C0067D74B1A1DF0BDBF663291192B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GooseModdingAPI.pdb

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\FOR MOD-MAKERS\GooseMod_DefaultSolution\GooseModdingAPI\obj\Release\GooseModdingAPI.pdb
Size 25KB
SHA256 4e4eb668831c91756eb030045d118ebd069fda0b0e0065ee2467c4c1c382cdd8
MD5 5e0ccb3bd78be9cd539fef6e4005e47a
SHA1 9a28756dffdef59d36bf42cb9cc8e02e454026d2
SHA512 4c58e1d9d77c42500c3d91314257f563a6b3af627ae0d5ec257b38a8b8008b47ad10b8b3a0661bc72a12bdaf549a33453a971802542f5c719fc979fa9f6c1372
SSDEEP 192:ViAQAAhmCU3WkdTw3lYiDIqMjT3GOit10fAUNDuY8Y0W74KhszVdSRyYjfYRNU29:Ehm8iTw1YxH3GOisNJzdc
TLSH
T188C24F56BB50CA33D81A85343EAF8F1D5334FD884B829B4F6385B26D3DB23652D89714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GooseDesktop.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe
Size 221KB
SHA256 90aee2294e68cb4771dddf2c303845c61fb344743e5a3d2322bf81002a7500db
MD5 bc8dc78f2c81ec0b9b20725ab46edefa
SHA1 117c516c1bb6fb85442170345854f896b023a088
SHA512 21a407e52a754b8fe1960bdd12606b9165f7ae6c911f42bfa16e7d0248272d7aef90e076e4f443cdec4d3925cb52e841c5659fc0244831b2790d83c470932def
SSDEEP 3072:fzebbi+n35n6u4WhGISz0tFvaxWt5H3ANdl3Mn4bqwyW13B26wqIl9nNwQ3WdZj:fza5n6uAuCW74bqwye3ijlDwQcZ
TLSH
T1FA24BF82E56A4A72CDBE8A37D87326015A3278AFDD26D79904CCD52C34D34C44E627BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tvjccxl2.yh0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvjccxl2.yh0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1464-129-0x0000000002A60000-0x0000000002A7E000-memory.dmp

Download

memory/1464-31-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Download

memory/1464-146-0x000000001BC10000-0x000000001BC96000-memory.dmp

Download

memory/1464-160-0x000000001D430000-0x000000001D43A000-memory.dmp

Download

memory/1464-174-0x000000001B580000-0x000000001B592000-memory.dmp

Download

memory/1464-175-0x000000001B5B0000-0x000000001B5BA000-memory.dmp

Download

memory/1464-176-0x000000001AC90000-0x000000001AC9C000-memory.dmp

Download

memory/1464-369-0x000000001ABA0000-0x000000001ABA8000-memory.dmp

Download

memory/1464-0-0x0000000000870000-0x00000000008C8000-memory.dmp

Download

memory/1464-128-0x000000001DD00000-0x000000001DE46000-memory.dmp

Download

memory/1464-127-0x000000001CF50000-0x000000001CFC6000-memory.dmp

Download

memory/1464-87-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Download

memory/4336-188-0x00000000006C0000-0x0000000000BDE000-memory.dmp

Download

memory/4344-178-0x00000259A0D90000-0x00000259A0DB2000-memory.dmp

Download

memory/4388-372-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4388-368-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4388-367-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4388-361-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/5084-342-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-356-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-343-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-341-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-345-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-346-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-347-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-349-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-348-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-350-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-351-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-352-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-355-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-353-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-354-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-344-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-357-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-360-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-340-0x00000000055F0000-0x00000000055FA000-memory.dmp

Download

memory/5084-358-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-359-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-362-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-364-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-366-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-363-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-365-0x0000000008340000-0x0000000008350000-memory.dmp

Download

memory/5084-339-0x00000000052E0000-0x00000000052EA000-memory.dmp

Download

memory/5084-330-0x0000000005950000-0x0000000005EF4000-memory.dmp

Download

memory/5084-329-0x00000000052F0000-0x0000000005382000-memory.dmp

Download

memory/5084-328-0x00000000008C0000-0x00000000008FE000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads