sheetrat | 31d54f8ca8b8f38857b719f97ad4e88218256bcf2690b3ae876196a4366abf57

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NursultanCrack.exe
Size 360KB
Sample260710-w7tk3se12m
SHA256 31d54f8ca8b8f38857b719f97ad4e88218256bcf2690b3ae876196a4366abf57
MD5 35e7f4289f5856d4265ec67987f8d30d
SHA1 dd053a9b191b448d1db8bd3722a902c86b0f02d3
SHA512 b1b0546b94c5597df63a2c945863410616040cbbcea358c57d6194736eb6066719190b69da960188395d1fd88017235d29efc3b6f56ade95ab8d90f0329f1b1c
SSDEEP 6144:u52Ewp4YM3bxNF3r209EdRh+7lb8qFjG5ccRFRwWaXv6:A2EfY6J34dRWiqjCtnG
TLSH
T1BA74811CBE51E8C4CE692FF38BE65061577315C63EE2E253364A6EF8C7443A649A207C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_tzxpxvuvnkfviwjg execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.4

Campaign

Sheet_tzxpxvuvnkfviwjg

91.92.42.94:1030

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/692-0-0x00000000000F0000-0x0000000000150000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdMicrosoft Azure DevOps.exe"	NursultanCrack.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
5536	xdwdRuntimeBroker.exe
5832	xdwdMicrosoft Azure DevOps.exe

Loads dropped DLL 64 IoCs

pid	Process
4068	Process not Found
4656	Process not Found
6100	Process not Found
724	Process not Found
4736	Process not Found
6028	Process not Found
5536	xdwdRuntimeBroker.exe
4996	Process not Found
2492	Process not Found
4272	Process not Found
5140	Process not Found
5744	Process not Found
5832	xdwdMicrosoft Azure DevOps.exe
428	Process not Found
2008	Process not Found
6088	Process not Found
1372	Process not Found
5740	Process not Found
4164	Process not Found
4348	Process not Found
3312	Process not Found
4828	Process not Found
3344	Process not Found
4652	Process not Found
5408	Process not Found
2792	Process not Found
4380	Process not Found
4324	Process not Found
800	Process not Found
2004	Process not Found
4256	Process not Found
1608	Process not Found
4736	Process not Found
5752	Process not Found
1684	Process not Found
1432	Process not Found
5756	Process not Found
2872	Process not Found
5584	Process not Found
3860	Process not Found
4188	Process not Found
4552	Process not Found
5396	Process not Found
5760	Process not Found
5908	Process not Found
5808	Process not Found
6008	Process not Found
6076	Process not Found
3176	Process not Found
3804	Process not Found
6040	Process not Found
5548	Process not Found
4692	Process not Found
1160	Process not Found
5028	Process not Found
4452	Process not Found
1308	Process not Found
2792	Process not Found
4732	Process not Found
5540	Process not Found
5148	Process not Found
2012	Process not Found
2716	Process not Found
5400	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\xdwdRuntimeBroker.exe"	NursultanCrack.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	NursultanCrack.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
436	schtasks.exe
4308	schtasks.exe
5632	schtasks.exe
3060	schtasks.exe
3360	schtasks.exe
1440	schtasks.exe
2084	schtasks.exe
2932	schtasks.exe
2236	schtasks.exe
4800	schtasks.exe
1384	schtasks.exe
3396	schtasks.exe
5164	schtasks.exe
2328	schtasks.exe
2724	schtasks.exe
244	schtasks.exe
2304	schtasks.exe
3100	schtasks.exe
2004	schtasks.exe
4728	schtasks.exe
5896	schtasks.exe
2420	schtasks.exe
5812	schtasks.exe
4164	schtasks.exe
3604	schtasks.exe
2864	schtasks.exe
4932	schtasks.exe
5184	schtasks.exe
5488	schtasks.exe
4916	schtasks.exe
724	schtasks.exe
5956	schtasks.exe
2388	schtasks.exe
1112	schtasks.exe
5716	schtasks.exe
3512	schtasks.exe
2492	schtasks.exe
4976	schtasks.exe
3392	schtasks.exe
5100	schtasks.exe
3928	schtasks.exe
5000	schtasks.exe
3876	schtasks.exe
4328	schtasks.exe
3412	schtasks.exe
3208	schtasks.exe
4572	schtasks.exe
5748	schtasks.exe
1908	schtasks.exe
1432	schtasks.exe
4824	schtasks.exe
6104	schtasks.exe
5568	schtasks.exe
4232	schtasks.exe
2320	schtasks.exe
5248	schtasks.exe
2788	schtasks.exe
2540	schtasks.exe
5552	schtasks.exe
1144	schtasks.exe
360	schtasks.exe
4384	schtasks.exe
1724	schtasks.exe
4168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe
5536	xdwdRuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	NursultanCrack.exe
Token: SeDebugPrivilege	5536	xdwdRuntimeBroker.exe
Token: SeDebugPrivilege	5832	xdwdMicrosoft Azure DevOps.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 1864	692	NursultanCrack.exe	87
PID 1864 wrote to memory of 4976	1864	CMD.exe	89
PID 692 wrote to memory of 5380	692	NursultanCrack.exe	90
PID 5380 wrote to memory of 5748	5380	CMD.exe	92
PID 692 wrote to memory of 2144	692	NursultanCrack.exe	93
PID 2144 wrote to memory of 1384	2144	CMD.exe	97
PID 692 wrote to memory of 3132	692	NursultanCrack.exe	98
PID 3132 wrote to memory of 2004	3132	CMD.exe	100
PID 692 wrote to memory of 6016	692	NursultanCrack.exe	101
PID 6016 wrote to memory of 4728	6016	CMD.exe	103
PID 692 wrote to memory of 4840	692	NursultanCrack.exe	104
PID 4840 wrote to memory of 4716	4840	CMD.exe	106
PID 5536 wrote to memory of 4388	5536	xdwdRuntimeBroker.exe	108
PID 4388 wrote to memory of 3604	4388	CMD.exe	110
PID 692 wrote to memory of 3944	692	NursultanCrack.exe	111
PID 3944 wrote to memory of 436	3944	CMD.exe	113
PID 692 wrote to memory of 1964	692	NursultanCrack.exe	114
PID 1964 wrote to memory of 5096	1964	CMD.exe	116
PID 692 wrote to memory of 5936	692	NursultanCrack.exe	117
PID 5936 wrote to memory of 6060	5936	CMD.exe	119
PID 692 wrote to memory of 908	692	NursultanCrack.exe	120
PID 908 wrote to memory of 5248	908	CMD.exe	122
PID 5536 wrote to memory of 5832	5536	xdwdRuntimeBroker.exe	123
PID 692 wrote to memory of 968	692	NursultanCrack.exe	124
PID 968 wrote to memory of 1908	968	CMD.exe	126
PID 5832 wrote to memory of 5084	5832	xdwdMicrosoft Azure DevOps.exe	127
PID 5084 wrote to memory of 5568	5084	CMD.exe	129
PID 692 wrote to memory of 5496	692	NursultanCrack.exe	130
PID 5496 wrote to memory of 4308	5496	CMD.exe	132
PID 5832 wrote to memory of 5940	5832	xdwdMicrosoft Azure DevOps.exe	133
PID 5940 wrote to memory of 5956	5940	CMD.exe	135
PID 692 wrote to memory of 4952	692	NursultanCrack.exe	136
PID 4952 wrote to memory of 2932	4952	CMD.exe	138
PID 5832 wrote to memory of 2652	5832	xdwdMicrosoft Azure DevOps.exe	139
PID 2652 wrote to memory of 2788	2652	CMD.exe	141
PID 692 wrote to memory of 6124	692	NursultanCrack.exe	142
PID 6124 wrote to memory of 3928	6124	CMD.exe	144
PID 5832 wrote to memory of 1648	5832	xdwdMicrosoft Azure DevOps.exe	145
PID 1648 wrote to memory of 5552	1648	CMD.exe	147
PID 692 wrote to memory of 5268	692	NursultanCrack.exe	148
PID 5268 wrote to memory of 5896	5268	CMD.exe	150
PID 5832 wrote to memory of 1652	5832	xdwdMicrosoft Azure DevOps.exe	151
PID 1652 wrote to memory of 1120	1652	CMD.exe	153
PID 692 wrote to memory of 4688	692	NursultanCrack.exe	154
PID 4688 wrote to memory of 1360	4688	CMD.exe	156
PID 5832 wrote to memory of 1092	5832	xdwdMicrosoft Azure DevOps.exe	157
PID 1092 wrote to memory of 2084	1092	CMD.exe	159
PID 692 wrote to memory of 4628	692	NursultanCrack.exe	160
PID 4628 wrote to memory of 3396	4628	CMD.exe	162
PID 5832 wrote to memory of 2508	5832	xdwdMicrosoft Azure DevOps.exe	163
PID 2508 wrote to memory of 4168	2508	CMD.exe	165
PID 692 wrote to memory of 4484	692	NursultanCrack.exe	166
PID 4484 wrote to memory of 1892	4484	CMD.exe	168
PID 5832 wrote to memory of 1204	5832	xdwdMicrosoft Azure DevOps.exe	169
PID 1204 wrote to memory of 5796	1204	CMD.exe	171
PID 692 wrote to memory of 5416	692	NursultanCrack.exe	172
PID 5416 wrote to memory of 724	5416	CMD.exe	174
PID 5832 wrote to memory of 4500	5832	xdwdMicrosoft Azure DevOps.exe	175
PID 4500 wrote to memory of 5632	4500	CMD.exe	177
PID 692 wrote to memory of 3932	692	NursultanCrack.exe	178
PID 3932 wrote to memory of 2864	3932	CMD.exe	180
PID 5832 wrote to memory of 2068	5832	xdwdMicrosoft Azure DevOps.exe	181
PID 2068 wrote to memory of 2236	2068	CMD.exe	183
PID 692 wrote to memory of 2364	692	NursultanCrack.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NursultanCrack.exe
"C:\Users\Admin\AppData\Local\Temp\NursultanCrack.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP Upgrade" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP Upgrade" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Word Host.exe" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\xdwdRuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Word Host.exe" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\xdwdRuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1384
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:4716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:5096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:6060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4308
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:3928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:1360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:1892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:2364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:4716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:3536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:2524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:6120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:2612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:4764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:5504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:3196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:2024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:4104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:2628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:2848
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:5916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:2800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:3532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:1740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:2972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:3180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:5280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:5360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    PID:4888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:2472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:5760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:3256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  PID:812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4916

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\xdwdRuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\xdwdRuntimeBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3604
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5568
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5956
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2788
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5552
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:1120
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2084
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4168
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:5796
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5632
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2236
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4100
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1144
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:1752
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:360
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4788
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5164
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4804
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3412
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:1108
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3392
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:5620
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2724
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:1744
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:2964
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:5856
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4232
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:3596
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:244
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:248
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5812
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:1792
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5000
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:1708
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4800
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4372
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3208
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:1876
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:5796
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:5048
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:4928
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4924
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3512
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4736
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4384
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:3536
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1432
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:1572
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2492
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:5372
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:4272
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:5640
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5184
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4784
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:780
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4520
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      PID:2964
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:5828
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4572
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:4264
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1440
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
    3⤵
    PID:200
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-76-0x00007FFE1B770000-0x00007FFE1C114000-memory.dmp

Download

memory/692-2-0x00007FFE1B770000-0x00007FFE1C114000-memory.dmp

Download

memory/692-3-0x00007FFE1B770000-0x00007FFE1C114000-memory.dmp

Download

memory/692-41-0x00007FFE1B770000-0x00007FFE1C114000-memory.dmp

Download

memory/692-1-0x00007FFE1B8FF000-0x00007FFE1B900000-memory.dmp

Download

memory/692-0-0x00000000000F0000-0x0000000000150000-memory.dmp

Download

memory/692-139-0x00007FFE1B770000-0x00007FFE1C114000-memory.dmp

Download

memory/5536-144-0x00007FFE27990000-0x00007FFE279B2000-memory.dmp

Download

memory/5536-151-0x00007FFE27990000-0x00007FFE279B2000-memory.dmp

Download

memory/5536-150-0x000000001C100000-0x000000001C1AE000-memory.dmp

Download

memory/5536-156-0x000000001C100000-0x000000001C1AE000-memory.dmp

Download

memory/5536-157-0x00007FFE27990000-0x00007FFE279B2000-memory.dmp

Download

memory/5832-155-0x00007FFE27990000-0x00007FFE279B2000-memory.dmp

Download

memory/5832-164-0x00007FFE27990000-0x00007FFE279B2000-memory.dmp

Download