sheetrat | 188585b56b1f5500731a02d57d7bf833d04b03f2a47d7f8d179ddf5397b33b10

Analysis

user interaction
yes
max time kernel
142s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 314KB
Sample260712-s8hcnaev3y
SHA256 188585b56b1f5500731a02d57d7bf833d04b03f2a47d7f8d179ddf5397b33b10
MD5 fa7ebb6644c40a913a824a78cf388c3f
SHA1 8274723dd2aeebabd757f9d582656000667b7f20
SHA512 bb7c833a6fd7ca6cb7dff1e1b60909b034495e85aa37f0b41d54d9026c3b5b575de24370894031cbb4482cd40f5bb075357f41638d5ca242b66022e0c2e542be
SSDEEP 6144:cz3JPs+gXfY3r209+YftoFFCAbY9tTLGcfGWS6Zh:ctgQ3TFRLLHG0
TLSH
T16164D70CBE52F915CF7E3D73CBE29061577221C63E129216374A2EF853553BA98A21BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.7

193.161.193.99:1194

Attributes

localhost
127.0.0.1:3765

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4408-0-0x00000000001C0000-0x0000000000214000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\xdwdAdobe Photoshop Upgrade.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 52 IoCs

pid	Process
1748	Process not Found
4424	Process not Found
5156	Process not Found
6112	Process not Found
936	Process not Found
2672	Process not Found
3776	Process not Found
3600	WmiApSrv.exe
3536	Process not Found
3012	Process not Found
5696	Process not Found
5128	Process not Found
3064	Process not Found
5416	Process not Found
2892	Process not Found
1748	Process not Found
2256	Process not Found
4860	Process not Found
4528	Process not Found
4524	Process not Found
1224	Process not Found
2916	Process not Found
1728	Process not Found
5408	Process not Found
3808	Process not Found
1748	Process not Found
3000	taskmgr.exe
3184	Process not Found
2548	Process not Found
5696	Process not Found
4064	svchost.exe
2916	Process not Found
432	Process not Found
5956	Process not Found
2464	Process not Found
4208	Process not Found
4860	Process not Found
4772	Process not Found
6108	Process not Found
5208	Process not Found
2916	Process not Found
4456	Process not Found
4404	Process not Found
3816	Process not Found
4424	Process not Found
608	Process not Found
3288	Process not Found
1796	Process not Found
4580	Process not Found
3540	Process not Found
932	Process not Found
4248	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 46 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe
2456	schtasks.exe
4920	schtasks.exe
2136	schtasks.exe
3120	schtasks.exe
3272	schtasks.exe
5140	schtasks.exe
400	schtasks.exe
4136	schtasks.exe
1400	schtasks.exe
5696	schtasks.exe
1196	schtasks.exe
1680	schtasks.exe
6080	schtasks.exe
5216	schtasks.exe
5008	schtasks.exe
2452	schtasks.exe
1508	schtasks.exe
3480	schtasks.exe
5544	schtasks.exe
2848	schtasks.exe
1544	schtasks.exe
4040	schtasks.exe
3988	schtasks.exe
3796	schtasks.exe
1188	schtasks.exe
4592	schtasks.exe
2956	schtasks.exe
3748	schtasks.exe
1448	schtasks.exe
4356	schtasks.exe
5216	schtasks.exe
1140	schtasks.exe
3888	schtasks.exe
6024	schtasks.exe
1564	schtasks.exe
2996	schtasks.exe
4192	schtasks.exe
2776	schtasks.exe
5856	schtasks.exe
2952	schtasks.exe
1740	schtasks.exe
1972	schtasks.exe
2428	schtasks.exe
4812	schtasks.exe
1020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
4408	Client.exe
3600	WmiApSrv.exe
3600	WmiApSrv.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
4064	svchost.exe
4064	svchost.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	Client.exe
Token: SeDebugPrivilege	3000	taskmgr.exe
Token: SeSystemProfilePrivilege	3000	taskmgr.exe
Token: SeCreateGlobalPrivilege	3000	taskmgr.exe
Token: SeSecurityPrivilege	3000	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3000	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3000	taskmgr.exe
3000	taskmgr.exe
3000	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 5680	4408	Client.exe	88
PID 5680 wrote to memory of 1564	5680	CMD.exe	90
PID 4408 wrote to memory of 4816	4408	Client.exe	91
PID 4816 wrote to memory of 3748	4816	CMD.exe	93
PID 4408 wrote to memory of 5104	4408	Client.exe	94
PID 5104 wrote to memory of 2452	5104	CMD.exe	96
PID 4408 wrote to memory of 5400	4408	Client.exe	101
PID 5400 wrote to memory of 2136	5400	CMD.exe	103
PID 4408 wrote to memory of 5860	4408	Client.exe	104
PID 5860 wrote to memory of 2996	5860	CMD.exe	106
PID 4408 wrote to memory of 4252	4408	Client.exe	109
PID 4252 wrote to memory of 4136	4252	CMD.exe	111
PID 4408 wrote to memory of 4376	4408	Client.exe	112
PID 4376 wrote to memory of 1740	4376	CMD.exe	114
PID 4408 wrote to memory of 4748	4408	Client.exe	115
PID 4748 wrote to memory of 1972	4748	CMD.exe	117
PID 4408 wrote to memory of 5648	4408	Client.exe	118
PID 5648 wrote to memory of 1508	5648	CMD.exe	120
PID 4408 wrote to memory of 4568	4408	Client.exe	121
PID 4568 wrote to memory of 4192	4568	CMD.exe	123
PID 4408 wrote to memory of 568	4408	Client.exe	125
PID 568 wrote to memory of 3120	568	CMD.exe	127
PID 4408 wrote to memory of 2120	4408	Client.exe	128
PID 2120 wrote to memory of 3988	2120	CMD.exe	130
PID 4408 wrote to memory of 5676	4408	Client.exe	131
PID 5676 wrote to memory of 2456	5676	CMD.exe	133
PID 4408 wrote to memory of 4612	4408	Client.exe	134
PID 4612 wrote to memory of 3796	4612	CMD.exe	136
PID 4408 wrote to memory of 4552	4408	Client.exe	137
PID 4552 wrote to memory of 2776	4552	CMD.exe	139
PID 4408 wrote to memory of 1872	4408	Client.exe	140
PID 1872 wrote to memory of 1400	1872	CMD.exe	142
PID 4408 wrote to memory of 5888	4408	Client.exe	143
PID 5888 wrote to memory of 5696	5888	CMD.exe	145
PID 4408 wrote to memory of 3792	4408	Client.exe	146
PID 3792 wrote to memory of 3272	3792	CMD.exe	148
PID 4408 wrote to memory of 4868	4408	Client.exe	149
PID 4868 wrote to memory of 5856	4868	CMD.exe	151
PID 4408 wrote to memory of 3772	4408	Client.exe	152
PID 3772 wrote to memory of 1448	3772	CMD.exe	154
PID 4408 wrote to memory of 3804	4408	Client.exe	155
PID 3804 wrote to memory of 1196	3804	CMD.exe	157
PID 4408 wrote to memory of 2084	4408	Client.exe	158
PID 2084 wrote to memory of 1680	2084	CMD.exe	160
PID 4408 wrote to memory of 6012	4408	Client.exe	162
PID 6012 wrote to memory of 3480	6012	CMD.exe	164
PID 4408 wrote to memory of 4776	4408	Client.exe	165
PID 4776 wrote to memory of 5544	4776	CMD.exe	167
PID 4408 wrote to memory of 2544	4408	Client.exe	168
PID 2544 wrote to memory of 5008	2544	CMD.exe	170
PID 4408 wrote to memory of 4832	4408	Client.exe	172
PID 4832 wrote to memory of 4920	4832	CMD.exe	174
PID 4408 wrote to memory of 4836	4408	Client.exe	175
PID 4836 wrote to memory of 3888	4836	CMD.exe	177
PID 4408 wrote to memory of 784	4408	Client.exe	178
PID 784 wrote to memory of 6024	784	CMD.exe	180
PID 4408 wrote to memory of 5688	4408	Client.exe	181
PID 5688 wrote to memory of 1188	5688	CMD.exe	183
PID 4408 wrote to memory of 5180	4408	Client.exe	184
PID 5180 wrote to memory of 4356	5180	CMD.exe	186
PID 4408 wrote to memory of 4560	4408	Client.exe	187
PID 4560 wrote to memory of 2848	4560	CMD.exe	189
PID 4408 wrote to memory of 3480	4408	Client.exe	190
PID 3480 wrote to memory of 5216	3480	CMD.exe	192

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "IntelliJ IDEA" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "IntelliJ IDEA" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6024
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2848
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:400

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3600

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3000-568-0x00007FFC1AF60000-0x00007FFC1AF82000-memory.dmp

Download

memory/3000-676-0x00007FFC1AF60000-0x00007FFC1AF82000-memory.dmp

Download

memory/3000-575-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3000-576-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3000-577-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3000-578-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3000-580-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3000-579-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3000-569-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3000-571-0x0000023119050000-0x0000023119051000-memory.dmp

Download

memory/3600-104-0x00007FFC1AF60000-0x00007FFC1AF82000-memory.dmp

Download

memory/3600-187-0x00007FFC1AF60000-0x00007FFC1AF82000-memory.dmp

Download

memory/4064-677-0x00007FFC1AF60000-0x00007FFC1AF82000-memory.dmp

Download

memory/4064-759-0x00007FFC1AF60000-0x00007FFC1AF82000-memory.dmp

Download

memory/4408-7-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-22-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-8-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-0-0x00000000001C0000-0x0000000000214000-memory.dmp

Download

memory/4408-6-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-5-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-4-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-3-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-2-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-102-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download

memory/4408-1-0x00007FFC12B6F000-0x00007FFC12B70000-memory.dmp

Download

memory/4408-132-0x00007FFC129E0000-0x00007FFC13384000-memory.dmp

Download