sheetrat | beb7cd07d87006fac9eaf83f27768e0010a87fa8467599b0ed10894fed475243

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
171s
max time network
169s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 307KB
Sample260712-tbbpaaew2v
SHA256 beb7cd07d87006fac9eaf83f27768e0010a87fa8467599b0ed10894fed475243
MD5 1e21f315683d6b9d0d568b1988ac389c
SHA1 8dc81e69573294b7e69510402a79e23ca45845a6
SHA512 a45ebc443fabdeb289cb1b148d835050f3629202e628817ab910a73a70e6193093aad1e52654663354e2f323ab38611eabebf5a05897a782ff560f0a6db1349f
SSDEEP 6144:hizbTGqIVe3r209V3Q/b0tov3EXXL5WS9L:hizbT33ZgQpsa
TLSH
T14464E81CBE51F815CF7A3D77CBE29061577212C23E22A222374A2FF847553A649A31BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.7

193.161.193.99:1194

Attributes

localhost
127.0.0.1:3765

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3948-0-0x0000000000AF0000-0x0000000000B44000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\xdwdAdobe Photoshop Upgrade.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 61 IoCs

pid	Process
2904	Process not Found
6016	Process not Found
1436	Process not Found
5536	Process not Found
3844	Process not Found
1912	Process not Found
4796	WmiApSrv.exe
2816	Process not Found
5428	Process not Found
5880	Process not Found
3020	Process not Found
1012	Process not Found
1904	taskmgr.exe
1232	Process not Found
4220	Process not Found
5904	Process not Found
5272	svchost.exe
828	Process not Found
3916	Process not Found
5648	Process not Found
3548	Process not Found
3552	Process not Found
4720	Process not Found
4336	Process not Found
2720	Process not Found
5948	Process not Found
5332	Process not Found
1980	Process not Found
5648	Process not Found
2900	Process not Found
4612	Process not Found
2388	Process not Found
3520	Process not Found
3672	Process not Found
5700	Process not Found
5500	Process not Found
2644	Process not Found
2240	Process not Found
4084	Process not Found
1648	Process not Found
3552	Process not Found
4704	Process not Found
4112	Process not Found
5264	Process not Found
5936	Process not Found
1268	Process not Found
4384	Process not Found
2872	Process not Found
4872	Process not Found
5512	Process not Found
264	Process not Found
5784	Process not Found
3888	Process not Found
3028	Process not Found
4624	Process not Found
5500	Process not Found
4640	Process not Found
2508	Process not Found
5468	Process not Found
4332	Process not Found
4780	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 55 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4900	schtasks.exe
3476	schtasks.exe
1392	schtasks.exe
3768	schtasks.exe
5832	schtasks.exe
3752	schtasks.exe
988	schtasks.exe
5004	schtasks.exe
1264	schtasks.exe
5500	schtasks.exe
5828	schtasks.exe
2324	schtasks.exe
552	schtasks.exe
4224	schtasks.exe
2096	schtasks.exe
2504	schtasks.exe
4908	schtasks.exe
5284	schtasks.exe
5500	schtasks.exe
1976	schtasks.exe
4400	schtasks.exe
4520	schtasks.exe
720	schtasks.exe
3064	schtasks.exe
4320	schtasks.exe
4480	schtasks.exe
5284	schtasks.exe
4584	schtasks.exe
788	schtasks.exe
5936	schtasks.exe
2644	schtasks.exe
4276	schtasks.exe
3452	schtasks.exe
1232	schtasks.exe
5184	schtasks.exe
3368	schtasks.exe
3112	schtasks.exe
5132	schtasks.exe
552	schtasks.exe
1052	schtasks.exe
432	schtasks.exe
1224	schtasks.exe
476	schtasks.exe
3224	schtasks.exe
1012	schtasks.exe
1880	schtasks.exe
4992	schtasks.exe
2812	schtasks.exe
4132	schtasks.exe
3692	schtasks.exe
5656	schtasks.exe
4320	schtasks.exe
2352	schtasks.exe
1344	schtasks.exe
3412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
4796	WmiApSrv.exe
4796	WmiApSrv.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
5272	svchost.exe
5272	svchost.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1904	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	Client.exe
Token: SeDebugPrivilege	1904	taskmgr.exe
Token: SeSystemProfilePrivilege	1904	taskmgr.exe
Token: SeCreateGlobalPrivilege	1904	taskmgr.exe
Token: SeSecurityPrivilege	1904	taskmgr.exe
Token: SeTakeOwnershipPrivilege	1904	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1412	3948	Client.exe	87
PID 1412 wrote to memory of 4900	1412	CMD.exe	89
PID 3948 wrote to memory of 5252	3948	Client.exe	90
PID 5252 wrote to memory of 4224	5252	CMD.exe	92
PID 3948 wrote to memory of 972	3948	Client.exe	93
PID 972 wrote to memory of 4400	972	CMD.exe	95
PID 3948 wrote to memory of 2396	3948	Client.exe	100
PID 2396 wrote to memory of 476	2396	CMD.exe	102
PID 3948 wrote to memory of 4988	3948	Client.exe	105
PID 4988 wrote to memory of 3476	4988	CMD.exe	107
PID 3948 wrote to memory of 716	3948	Client.exe	108
PID 716 wrote to memory of 5004	716	CMD.exe	110
PID 3948 wrote to memory of 1044	3948	Client.exe	111
PID 1044 wrote to memory of 3112	1044	CMD.exe	113
PID 3948 wrote to memory of 724	3948	Client.exe	114
PID 724 wrote to memory of 1392	724	CMD.exe	116
PID 3948 wrote to memory of 2764	3948	Client.exe	118
PID 2764 wrote to memory of 4520	2764	CMD.exe	120
PID 3948 wrote to memory of 4672	3948	Client.exe	121
PID 4672 wrote to memory of 788	4672	CMD.exe	123
PID 3948 wrote to memory of 4232	3948	Client.exe	125
PID 4232 wrote to memory of 3768	4232	CMD.exe	127
PID 3948 wrote to memory of 2172	3948	Client.exe	129
PID 2172 wrote to memory of 2096	2172	CMD.exe	131
PID 3948 wrote to memory of 3564	3948	Client.exe	132
PID 3564 wrote to memory of 5132	3564	CMD.exe	134
PID 3948 wrote to memory of 1580	3948	Client.exe	135
PID 1580 wrote to memory of 3692	1580	CMD.exe	137
PID 3948 wrote to memory of 5760	3948	Client.exe	138
PID 5760 wrote to memory of 720	5760	CMD.exe	140
PID 3948 wrote to memory of 5620	3948	Client.exe	141
PID 5620 wrote to memory of 3064	5620	CMD.exe	143
PID 3948 wrote to memory of 4508	3948	Client.exe	144
PID 4508 wrote to memory of 1264	4508	CMD.exe	146
PID 3948 wrote to memory of 1720	3948	Client.exe	147
PID 1720 wrote to memory of 4320	1720	CMD.exe	149
PID 3948 wrote to memory of 5752	3948	Client.exe	150
PID 5752 wrote to memory of 552	5752	CMD.exe	152
PID 3948 wrote to memory of 4256	3948	Client.exe	153
PID 4256 wrote to memory of 5936	4256	CMD.exe	155
PID 3948 wrote to memory of 1796	3948	Client.exe	156
PID 1796 wrote to memory of 5500	1796	CMD.exe	158
PID 3948 wrote to memory of 3728	3948	Client.exe	159
PID 3728 wrote to memory of 2644	3728	CMD.exe	161
PID 3948 wrote to memory of 4864	3948	Client.exe	162
PID 4864 wrote to memory of 2504	4864	CMD.exe	164
PID 3948 wrote to memory of 5268	3948	Client.exe	165
PID 5268 wrote to memory of 5832	5268	CMD.exe	167
PID 3948 wrote to memory of 5452	3948	Client.exe	168
PID 5452 wrote to memory of 4480	5452	CMD.exe	170
PID 3948 wrote to memory of 4720	3948	Client.exe	171
PID 4720 wrote to memory of 5284	4720	CMD.exe	173
PID 3948 wrote to memory of 788	3948	Client.exe	174
PID 788 wrote to memory of 4908	788	CMD.exe	176
PID 3948 wrote to memory of 5420	3948	Client.exe	177
PID 5420 wrote to memory of 5828	5420	CMD.exe	179
PID 3948 wrote to memory of 5904	3948	Client.exe	180
PID 5904 wrote to memory of 3752	5904	CMD.exe	182
PID 3948 wrote to memory of 4900	3948	Client.exe	183
PID 4900 wrote to memory of 2324	4900	CMD.exe	185
PID 3948 wrote to memory of 4180	3948	Client.exe	186
PID 4180 wrote to memory of 4276	4180	CMD.exe	188
PID 3948 wrote to memory of 5548	3948	Client.exe	189
PID 5548 wrote to memory of 4584	5548	CMD.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "IntelliJ IDEA" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "IntelliJ IDEA" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1264
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5832
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:6128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Local\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3412

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1904-187-0x00007FFC22DA0000-0x00007FFC22DC2000-memory.dmp

Download

memory/1904-295-0x00007FFC22DA0000-0x00007FFC22DC2000-memory.dmp

Download

memory/1904-221-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/1904-226-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/1904-222-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/1904-223-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/1904-224-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/1904-225-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/1904-215-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/1904-217-0x000001E317560000-0x000001E317561000-memory.dmp

Download

memory/3948-6-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/3948-2-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/3948-130-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/3948-102-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/3948-0-0x0000000000AF0000-0x0000000000B44000-memory.dmp

Download

memory/3948-19-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/3948-1-0x00007FFC0F00F000-0x00007FFC0F010000-memory.dmp

Download

memory/3948-5-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/3948-4-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/3948-3-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/4796-158-0x00007FFC22DA0000-0x00007FFC22DC2000-memory.dmp

Download

memory/4796-73-0x00007FFC22DA0000-0x00007FFC22DC2000-memory.dmp

Download

memory/5272-296-0x00007FFC22DA0000-0x00007FFC22DC2000-memory.dmp

Download

memory/5272-378-0x00007FFC22DA0000-0x00007FFC22DC2000-memory.dmp

Download