sheetrat | 086f9a7bfee4dffac78703e16748ad4c70e6890e5bcd72031918e7982ad0e641

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
reallycrack.exe
Size 795KB
Sample260708-tgadeab19j
SHA256 086f9a7bfee4dffac78703e16748ad4c70e6890e5bcd72031918e7982ad0e641
MD5 c0d8774d2726ece37f2e545a0daab3d2
SHA1 4bfdb2cc3b8e81f11f94dc157535e60417d7b8ba
SHA512 a9326c930f34eda4434e05b9ef44bc43a16495e642abb78984efebc6adf3bfe7a51f8260f89adbf75cb3f8e408e010866f272d3efba5e72fb9f5f5ee0a4febd7
SSDEEP 6144:sDk+yIlu5fZr8+3r2090p+hDbfjFilVaBfWNj32AYA/ESMSIFxjRWKaGPJun5W1:sDk+VA++3FxoVqfWF325mMSIDJRt
TLSH
T19D05A559BE11ED05CD372AF28AD1D37017710E817B12C21126B5BEE7FAE46E61E920EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.4

zykliya2513-40294.portmap.host:40294
u|]2Tk6vqE3:NLp*MQ=< RVd.lI+mFG~[HZ/A-Yg"Oebh?{w1&0D5> z@Jas!t4_}C#Uf

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/2180-0-0x0000000000860000-0x000000000092A000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdFileZilla.exe"	reallycrack.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
2052	xdwdFileZilla.exe
700	xdwdCorelDRAW.exe

Loads dropped DLL 64 IoCs

pid	Process
2156	Process not Found
2052	xdwdFileZilla.exe
4564	Process not Found
640	Process not Found
700	xdwdCorelDRAW.exe
2300	Process not Found
2924	Process not Found
2500	Process not Found
1064	Process not Found
1084	Process not Found
4908	Process not Found
4940	Process not Found
2916	Process not Found
3752	Process not Found
1864	WmiApSrv.exe
3032	Process not Found
2352	Process not Found
2408	Process not Found
3512	Process not Found
2668	Process not Found
4728	Process not Found
4588	Process not Found
4744	Process not Found
3144	Process not Found
2308	Process not Found
1252	Process not Found
2060	Process not Found
2564	Process not Found
3904	Process not Found
1028	Process not Found
1536	Process not Found
4956	Process not Found
2056	Process not Found
2096	Process not Found
2568	Process not Found
3508	Process not Found
3480	Process not Found
1488	Process not Found
556	Process not Found
3616	Process not Found
5012	Process not Found
2156	Process not Found
4932	Process not Found
3288	Process not Found
4680	Process not Found
1820	Process not Found
2416	Process not Found
756	Process not Found
2304	Process not Found
1768	Process not Found
3276	Process not Found
3760	Process not Found
2560	Process not Found
4144	Process not Found
1956	Process not Found
4632	Process not Found
1408	Process not Found
3084	Process not Found
820	Process not Found
760	Process not Found
2008	Process not Found
4088	Process not Found
4180	Process not Found
5060	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "C:\\Users\\Admin\\Videos\\xdwdCorelDRAW.exe"	reallycrack.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	reallycrack.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3968	schtasks.exe
1704	schtasks.exe
4088	schtasks.exe
4728	schtasks.exe
2408	schtasks.exe
2584	schtasks.exe
760	schtasks.exe
1724	schtasks.exe
2256	schtasks.exe
2056	schtasks.exe
2156	schtasks.exe
752	schtasks.exe
4420	schtasks.exe
1624	schtasks.exe
3236	schtasks.exe
760	schtasks.exe
3068	schtasks.exe
2060	schtasks.exe
4684	schtasks.exe
2672	schtasks.exe
1996	schtasks.exe
1716	schtasks.exe
2600	schtasks.exe
2312	schtasks.exe
2428	schtasks.exe
3288	schtasks.exe
3672	schtasks.exe
1792	schtasks.exe
3812	schtasks.exe
3508	schtasks.exe
384	schtasks.exe
1104	schtasks.exe
4672	schtasks.exe
4436	schtasks.exe
3048	schtasks.exe
2484	schtasks.exe
1996	schtasks.exe
2096	schtasks.exe
556	schtasks.exe
3352	schtasks.exe
760	schtasks.exe
1680	schtasks.exe
2616	schtasks.exe
4784	schtasks.exe
5100	schtasks.exe
1600	schtasks.exe
4320	schtasks.exe
1816	schtasks.exe
1040	schtasks.exe
812	schtasks.exe
4204	schtasks.exe
5052	schtasks.exe
876	schtasks.exe
4348	schtasks.exe
4420	schtasks.exe
2596	schtasks.exe
924	schtasks.exe
4148	schtasks.exe
4068	schtasks.exe
4160	schtasks.exe
4764	schtasks.exe
2440	schtasks.exe
4108	schtasks.exe
2304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2052	xdwdFileZilla.exe
2052	xdwdFileZilla.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe
2180	reallycrack.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	reallycrack.exe
Token: SeDebugPrivilege	2052	xdwdFileZilla.exe
Token: SeDebugPrivilege	700	xdwdCorelDRAW.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3284	2180	reallycrack.exe	87
PID 3284 wrote to memory of 988	3284	CMD.exe	89
PID 2180 wrote to memory of 3364	2180	reallycrack.exe	90
PID 3364 wrote to memory of 3968	3364	CMD.exe	92
PID 2180 wrote to memory of 1208	2180	reallycrack.exe	94
PID 1208 wrote to memory of 2596	1208	CMD.exe	97
PID 2180 wrote to memory of 3972	2180	reallycrack.exe	98
PID 3972 wrote to memory of 3288	3972	CMD.exe	100
PID 2052 wrote to memory of 2196	2052	xdwdFileZilla.exe	103
PID 2196 wrote to memory of 4764	2196	CMD.exe	105
PID 2052 wrote to memory of 1272	2052	xdwdFileZilla.exe	106
PID 1272 wrote to memory of 4672	1272	CMD.exe	108
PID 700 wrote to memory of 1828	700	xdwdCorelDRAW.exe	109
PID 1828 wrote to memory of 760	1828	CMD.exe	111
PID 2180 wrote to memory of 2120	2180	reallycrack.exe	112
PID 2120 wrote to memory of 2740	2120	CMD.exe	114
PID 2052 wrote to memory of 4868	2052	xdwdFileZilla.exe	117
PID 4868 wrote to memory of 1704	4868	CMD.exe	119
PID 2180 wrote to memory of 1044	2180	reallycrack.exe	120
PID 1044 wrote to memory of 4436	1044	CMD.exe	122
PID 2052 wrote to memory of 1712	2052	xdwdFileZilla.exe	123
PID 1712 wrote to memory of 1040	1712	CMD.exe	125
PID 2180 wrote to memory of 4168	2180	reallycrack.exe	128
PID 4168 wrote to memory of 2440	4168	CMD.exe	130
PID 2052 wrote to memory of 1344	2052	xdwdFileZilla.exe	131
PID 1344 wrote to memory of 1680	1344	CMD.exe	133
PID 2180 wrote to memory of 4196	2180	reallycrack.exe	134
PID 4196 wrote to memory of 812	4196	CMD.exe	136
PID 2052 wrote to memory of 2904	2052	xdwdFileZilla.exe	137
PID 2904 wrote to memory of 3140	2904	CMD.exe	139
PID 2180 wrote to memory of 5016	2180	reallycrack.exe	140
PID 5016 wrote to memory of 3048	5016	CMD.exe	142
PID 2052 wrote to memory of 2988	2052	xdwdFileZilla.exe	143
PID 2988 wrote to memory of 2484	2988	CMD.exe	145
PID 2180 wrote to memory of 2248	2180	reallycrack.exe	146
PID 2248 wrote to memory of 2256	2248	CMD.exe	148
PID 2052 wrote to memory of 4216	2052	xdwdFileZilla.exe	149
PID 4216 wrote to memory of 3068	4216	CMD.exe	151
PID 2180 wrote to memory of 5028	2180	reallycrack.exe	152
PID 5028 wrote to memory of 2068	5028	CMD.exe	154
PID 2052 wrote to memory of 3704	2052	xdwdFileZilla.exe	155
PID 3704 wrote to memory of 4108	3704	CMD.exe	157
PID 2180 wrote to memory of 2260	2180	reallycrack.exe	159
PID 2260 wrote to memory of 760	2260	CMD.exe	161
PID 2052 wrote to memory of 520	2052	xdwdFileZilla.exe	162
PID 520 wrote to memory of 1988	520	CMD.exe	164
PID 2180 wrote to memory of 2836	2180	reallycrack.exe	165
PID 2836 wrote to memory of 4088	2836	CMD.exe	167
PID 2052 wrote to memory of 3992	2052	xdwdFileZilla.exe	168
PID 3992 wrote to memory of 2304	3992	CMD.exe	170
PID 2180 wrote to memory of 1800	2180	reallycrack.exe	171
PID 1800 wrote to memory of 1104	1800	CMD.exe	173
PID 2052 wrote to memory of 1156	2052	xdwdFileZilla.exe	174
PID 1156 wrote to memory of 4068	1156	CMD.exe	176
PID 2180 wrote to memory of 3892	2180	reallycrack.exe	177
PID 3892 wrote to memory of 4160	3892	CMD.exe	179
PID 2052 wrote to memory of 3432	2052	xdwdFileZilla.exe	180
PID 3432 wrote to memory of 1996	3432	CMD.exe	182
PID 2180 wrote to memory of 1056	2180	reallycrack.exe	183
PID 1056 wrote to memory of 3672	1056	CMD.exe	185
PID 2052 wrote to memory of 4556	2052	xdwdFileZilla.exe	186
PID 4556 wrote to memory of 1680	4556	CMD.exe	188
PID 2180 wrote to memory of 4840	2180	reallycrack.exe	192
PID 4840 wrote to memory of 4728	4840	CMD.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\reallycrack.exe
"C:\Users\Admin\AppData\Local\Temp\reallycrack.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe"
    3⤵
    PID:988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\Videos\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\Videos\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4284
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:1504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:4632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:4012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:3192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4308
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:4860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2508

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1040
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:1680
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:3140
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:1988
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2304
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4068
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1996
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:4948
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:4452
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:1132
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4204
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2584
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:5004
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2460
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2672
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3812
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2584
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:4728
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4784
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:4400
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:2008
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4412
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:1628
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:4296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1996
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:3932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5052
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4148
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:5012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:384
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    PID:3792
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:5100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4348
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:2616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2312
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1716
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  PID:1996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2428

C:\Users\Admin\Videos\xdwdCorelDRAW.exe
C:\Users\Admin\Videos\xdwdCorelDRAW.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Visual Studio" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdFileZilla.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-81-0x00007FF956B80000-0x00007FF956BA2000-memory.dmp

Download

memory/700-72-0x00007FF956B80000-0x00007FF956BA2000-memory.dmp

Download

memory/1864-94-0x00007FF956B80000-0x00007FF956BA2000-memory.dmp

Download

memory/1864-87-0x00007FF956B80000-0x00007FF956BA2000-memory.dmp

Download

memory/2052-49-0x00007FF956B80000-0x00007FF956BA2000-memory.dmp

Download

memory/2052-86-0x00007FF956B80000-0x00007FF956BA2000-memory.dmp

Download

memory/2180-83-0x000000001BD00000-0x000000001BD10000-memory.dmp

Download

memory/2180-0-0x0000000000860000-0x000000000092A000-memory.dmp

Download

memory/2180-38-0x000000001BD00000-0x000000001BD10000-memory.dmp

Download

memory/2180-122-0x000000001D0C0000-0x000000001D136000-memory.dmp

Download

memory/2180-123-0x000000001E100000-0x000000001E246000-memory.dmp

Download

memory/2180-124-0x0000000002AC0000-0x0000000002ADE000-memory.dmp

Download