sheetrat | fe0e986d5cb5e754e98fbe1ff1cb0647c54188f29aee03ad339ccf278547e244

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 588KB
Sample260712-ten4saex2v
SHA256 fe0e986d5cb5e754e98fbe1ff1cb0647c54188f29aee03ad339ccf278547e244
MD5 8643dd12e3d5e2855502abdedf5baae4
SHA1 1766eabdf96bef71e4b06f1c0d313ae452dc42e6
SHA512 aea2d96bec790ffcf11637122d989a945b537532a32661e823deeef41232a185640da515f707e688a23dd60da6686a13787982e31ed408d8d6b9a04f77a28dae
SSDEEP 6144:ZEtAdTDcktQDF7X3r209URHrbSmHOaabBpLrlaNVdW58y8ZuAephj3iaDjX/+5+C:ZweLgJ3Y9bdCsNDW1CK1zLAn9
TLSH
T19AD4A30CBD92F805CF6E7DB3CBE2A4621B7210C27E129116270B6FF95B553B649A217C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.7

193.161.193.99:1194

Attributes

localhost
127.0.0.1:3765

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3180-0-0x0000000000ED0000-0x0000000000F6A000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdDaVinci Resolve.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 55 IoCs

pid	Process
6044	Process not Found
4152	Process not Found
3572	Process not Found
3256	Process not Found
3104	Process not Found
2876	Process not Found
5628	Process not Found
1884	Process not Found
4292	Process not Found
3372	Process not Found
1948	Process not Found
2420	Process not Found
5596	Process not Found
4784	WmiApSrv.exe
1144	Process not Found
5584	Process not Found
4768	Process not Found
1452	Process not Found
3676	rundll32.exe
1872	Process not Found
4452	Process not Found
4688	Process not Found
4876	Process not Found
5460	Process not Found
4128	Process not Found
4248	Process not Found
2272	Process not Found
3008	Process not Found
3860	Process not Found
2212	Process not Found
4612	Process not Found
4188	Process not Found
3404	Process not Found
2552	Process not Found
4392	Process not Found
3704	Process not Found
1764	Process not Found
628	Process not Found
3332	Process not Found
3924	Process not Found
5896	Process not Found
4272	Process not Found
108	Process not Found
3956	Process not Found
2276	Process not Found
1068	Process not Found
4552	Process not Found
4528	Process not Found
5280	Process not Found
564	Process not Found
5596	Process not Found
4400	Process not Found
5944	Process not Found
4692	Process not Found
2052	Process not Found

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\xdwdDaVinci Resolve.exe	Client.exe
File opened for modification	C:\Windows\xdwdDaVinci Resolve.exe	Client.exe
File created	C:\Windows\xdwd.dll	Client.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1452	schtasks.exe
3512	schtasks.exe
1200	schtasks.exe
3512	schtasks.exe
2040	schtasks.exe
4356	schtasks.exe
3704	schtasks.exe
2520	schtasks.exe
2476	schtasks.exe
4876	schtasks.exe
2772	schtasks.exe
6108	schtasks.exe
3204	schtasks.exe
3532	schtasks.exe
5628	schtasks.exe
2536	schtasks.exe
1412	schtasks.exe
1892	schtasks.exe
3392	schtasks.exe
3868	schtasks.exe
5088	schtasks.exe
3868	schtasks.exe
1584	schtasks.exe
948	schtasks.exe
4552	schtasks.exe
628	schtasks.exe
5284	schtasks.exe
3620	schtasks.exe
1304	schtasks.exe
4744	schtasks.exe
4460	schtasks.exe
5660	schtasks.exe
124	schtasks.exe
5820	schtasks.exe
1680	schtasks.exe
5668	schtasks.exe
1392	schtasks.exe
4340	schtasks.exe
5516	schtasks.exe
2040	schtasks.exe
1580	schtasks.exe
2312	schtasks.exe
120	schtasks.exe
3288	schtasks.exe
3332	schtasks.exe
1508	schtasks.exe
5924	schtasks.exe
5464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3376	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	Client.exe
Token: SeDebugPrivilege	3376	taskmgr.exe
Token: SeSystemProfilePrivilege	3376	taskmgr.exe
Token: SeCreateGlobalPrivilege	3376	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe
3376	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4132	3180	Client.exe	90
PID 4132 wrote to memory of 2476	4132	CMD.exe	92
PID 3180 wrote to memory of 4408	3180	Client.exe	93
PID 3180 wrote to memory of 5860	3180	Client.exe	95
PID 4408 wrote to memory of 1680	4408	CMD.exe	98
PID 5860 wrote to memory of 120	5860	CMD.exe	99
PID 3180 wrote to memory of 4728	3180	Client.exe	101
PID 4728 wrote to memory of 5668	4728	CMD.exe	103
PID 3180 wrote to memory of 2376	3180	Client.exe	104
PID 2376 wrote to memory of 3288	2376	CMD.exe	106
PID 3180 wrote to memory of 5080	3180	Client.exe	107
PID 5080 wrote to memory of 1452	5080	CMD.exe	109
PID 3180 wrote to memory of 3228	3180	Client.exe	110
PID 3228 wrote to memory of 3868	3228	CMD.exe	112
PID 3180 wrote to memory of 1484	3180	Client.exe	113
PID 1484 wrote to memory of 1392	1484	CMD.exe	115
PID 3180 wrote to memory of 5456	3180	Client.exe	116
PID 5456 wrote to memory of 3512	5456	CMD.exe	118
PID 3180 wrote to memory of 5056	3180	Client.exe	119
PID 5056 wrote to memory of 5284	5056	CMD.exe	121
PID 3180 wrote to memory of 5568	3180	Client.exe	125
PID 5568 wrote to memory of 4876	5568	CMD.exe	127
PID 3180 wrote to memory of 3452	3180	Client.exe	130
PID 3452 wrote to memory of 3532	3452	CMD.exe	132
PID 3180 wrote to memory of 5848	3180	Client.exe	134
PID 5848 wrote to memory of 3332	5848	CMD.exe	136
PID 3180 wrote to memory of 3904	3180	Client.exe	138
PID 3904 wrote to memory of 4340	3904	CMD.exe	140
PID 3180 wrote to memory of 2500	3180	Client.exe	141
PID 2500 wrote to memory of 1412	2500	CMD.exe	143
PID 3180 wrote to memory of 1996	3180	Client.exe	144
PID 1996 wrote to memory of 2772	1996	CMD.exe	146
PID 3180 wrote to memory of 3160	3180	Client.exe	147
PID 3160 wrote to memory of 1200	3160	CMD.exe	149
PID 3180 wrote to memory of 4308	3180	Client.exe	150
PID 4308 wrote to memory of 5516	4308	CMD.exe	152
PID 3180 wrote to memory of 4896	3180	Client.exe	153
PID 4896 wrote to memory of 2040	4896	CMD.exe	155
PID 3180 wrote to memory of 3676	3180	Client.exe	156
PID 3676 wrote to memory of 3620	3676	CMD.exe	158
PID 3180 wrote to memory of 1872	3180	Client.exe	159
PID 1872 wrote to memory of 1584	1872	CMD.exe	161
PID 3180 wrote to memory of 3012	3180	Client.exe	162
PID 3012 wrote to memory of 3512	3012	CMD.exe	164
PID 3180 wrote to memory of 4900	3180	Client.exe	166
PID 4900 wrote to memory of 1508	4900	CMD.exe	168
PID 3180 wrote to memory of 2460	3180	Client.exe	169
PID 2460 wrote to memory of 2040	2460	CMD.exe	171
PID 3180 wrote to memory of 784	3180	Client.exe	172
PID 784 wrote to memory of 5628	784	CMD.exe	174
PID 3180 wrote to memory of 5760	3180	Client.exe	175
PID 5760 wrote to memory of 1892	5760	CMD.exe	177
PID 3180 wrote to memory of 5504	3180	Client.exe	178
PID 5504 wrote to memory of 948	5504	CMD.exe	180
PID 3180 wrote to memory of 904	3180	Client.exe	181
PID 904 wrote to memory of 3392	904	CMD.exe	183
PID 3180 wrote to memory of 2444	3180	Client.exe	184
PID 2444 wrote to memory of 1304	2444	CMD.exe	186
PID 3180 wrote to memory of 3256	3180	Client.exe	187
PID 3256 wrote to memory of 1580	3256	CMD.exe	189
PID 3180 wrote to memory of 1320	3180	Client.exe	190
PID 1320 wrote to memory of 2312	1320	CMD.exe	192
PID 3180 wrote to memory of 2960	3180	Client.exe	193
PID 2960 wrote to memory of 3868	2960	CMD.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Dynamics Upgrade" /tr "C:\Windows\xdwdDaVinci Resolve.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Dynamics Upgrade" /tr "C:\Windows\xdwdDaVinci Resolve.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "KeePass" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Money.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "KeePass" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Money.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:2540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:2348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:1108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:2572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:1492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:5952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:1488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:628

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:4784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Loads dropped DLL
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3180-5-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/3180-2-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/3180-3-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/3180-4-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/3180-0-0x0000000000ED0000-0x0000000000F6A000-memory.dmp

Download

memory/3180-6-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/3180-120-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/3180-1-0x00007FF8C7C6F000-0x00007FF8C7C70000-memory.dmp

Download

memory/3376-45-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3376-42-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3376-41-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3376-43-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3376-44-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3376-40-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3376-28-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3376-30-0x000001DE387D0000-0x000001DE387D1000-memory.dmp

Download

memory/3676-345-0x00007FF8C0F00000-0x00007FF8C0F22000-memory.dmp

Download

memory/3676-346-0x00007FF8C0F00000-0x00007FF8C0F22000-memory.dmp

Download

memory/4784-287-0x00007FF8C0F00000-0x00007FF8C0F22000-memory.dmp

Download

memory/4784-374-0x00007FF8C0F00000-0x00007FF8C0F22000-memory.dmp

Download