sheetrat | 1eb56828adaa2793516a5d9ec806fd540df0b3cc654e4af4786314d201c688f8

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sea.exe
Size 435KB
Sample260712-yz43ysas9z
SHA256 1eb56828adaa2793516a5d9ec806fd540df0b3cc654e4af4786314d201c688f8
MD5 adaa2bbe93a228db3db69200fb2b0b94
SHA1 d30fa2bb57e7abae5ca620337479f1c3e9f0f8c7
SHA512 fe65039fe6aedf2008bdf229fee2da2f596f614f75ab5dd781d85412748e7ec8fc491108bafa374f98da9cfed6fbeda246fb677c0328cb5eae0cd8c93cb7b584
SSDEEP 6144:mwi8AhYQnrJZ5fuJe6VlWT8b9bcyzwSCqwrbx7gJbmj:mH86JNZZ8PVle8+yfXxm
TLSH
T1E794C40CFE91F805CE1A3DB3CFE614144B7165C12E219292356AAFFD8B9637658E227C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_avitjjslanbfeqoid execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_avitjjslanbfeqoid

eohkvjyip7.localto.net:8185

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/4948-0-0x0000000000B00000-0x0000000000B72000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Documents\\xdwdAdobe Premiere Pro Upgrade.exe"	sea.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	xdwdMicrosoft Dynamics CRM.exe

Executes dropped EXE 2 IoCs

pid	Process
3476	xdwdMicrosoft Dynamics CRM.exe
2924	xdwdAdobe Premiere Pro Upgrade.exe

Loads dropped DLL 56 IoCs

pid	Process
3772	Process not Found
1156	Process not Found
4272	Process not Found
1016	Process not Found
4404	Process not Found
4832	Process not Found
3476	xdwdMicrosoft Dynamics CRM.exe
1536	Process not Found
808	WmiApSrv.exe
1292	Process not Found
660	Process not Found
5112	Process not Found
400	Process not Found
4508	Process not Found
3040	Process not Found
4224	Process not Found
4644	Process not Found
2924	xdwdAdobe Premiere Pro Upgrade.exe
4080	Process not Found
1800	Process not Found
2264	Process not Found
3432	Process not Found
3468	Process not Found
2376	Process not Found
1412	Process not Found
4180	Process not Found
2192	Process not Found
3788	Process not Found
1636	Process not Found
1464	Process not Found
3560	Process not Found
4080	Process not Found
4592	Process not Found
4908	Process not Found
2808	Process not Found
2996	Process not Found
2000	Process not Found
3304	Process not Found
3052	Process not Found
4276	Process not Found
2684	Process not Found
2448	Process not Found
4476	Process not Found
3504	Process not Found
1404	Process not Found
3848	Process not Found
4908	Process not Found
992	Process not Found
1588	Process not Found
2352	Process not Found
4600	Process not Found
4508	Process not Found
4128	Process not Found
3884	Process not Found
4560	Process not Found
1628	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dsada = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdMicrosoft Dynamics CRM.exe"	sea.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	sea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdMicrosoft Dynamics CRM.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
408	schtasks.exe
3936	schtasks.exe
5112	schtasks.exe
2284	schtasks.exe
3468	schtasks.exe
3680	schtasks.exe
812	schtasks.exe
1544	schtasks.exe
2408	schtasks.exe
1800	schtasks.exe
1600	schtasks.exe
3528	schtasks.exe
4388	schtasks.exe
2928	schtasks.exe
4216	schtasks.exe
3404	schtasks.exe
2208	schtasks.exe
416	schtasks.exe
1040	schtasks.exe
2896	schtasks.exe
4780	schtasks.exe
2524	schtasks.exe
4188	schtasks.exe
2324	schtasks.exe
4060	schtasks.exe
1368	schtasks.exe
4652	schtasks.exe
1980	schtasks.exe
1516	schtasks.exe
4240	schtasks.exe
1820	schtasks.exe
2524	schtasks.exe
224	schtasks.exe
4552	schtasks.exe
872	schtasks.exe
3640	schtasks.exe
3292	schtasks.exe
3552	schtasks.exe
4276	schtasks.exe
1936	schtasks.exe
1476	schtasks.exe
1596	schtasks.exe
1468	schtasks.exe
4712	schtasks.exe
4500	schtasks.exe
1604	schtasks.exe
3892	schtasks.exe
2920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
4948	sea.exe
808	WmiApSrv.exe
808	WmiApSrv.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe
3476	xdwdMicrosoft Dynamics CRM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	sea.exe
Token: SeDebugPrivilege	3476	xdwdMicrosoft Dynamics CRM.exe
Token: SeDebugPrivilege	2924	xdwdAdobe Premiere Pro Upgrade.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4900	4948	sea.exe	92
PID 4900 wrote to memory of 408	4900	CMD.exe	94
PID 4948 wrote to memory of 1124	4948	sea.exe	95
PID 1124 wrote to memory of 812	1124	CMD.exe	97
PID 4948 wrote to memory of 3804	4948	sea.exe	98
PID 3804 wrote to memory of 3552	3804	CMD.exe	100
PID 4948 wrote to memory of 2296	4948	sea.exe	109
PID 2296 wrote to memory of 1604	2296	CMD.exe	111
PID 4948 wrote to memory of 4348	4948	sea.exe	114
PID 4348 wrote to memory of 1600	4348	CMD.exe	116
PID 4948 wrote to memory of 1340	4948	sea.exe	118
PID 1340 wrote to memory of 4240	1340	CMD.exe	120
PID 4948 wrote to memory of 3756	4948	sea.exe	121
PID 3756 wrote to memory of 3528	3756	CMD.exe	123
PID 4948 wrote to memory of 4688	4948	sea.exe	126
PID 4688 wrote to memory of 1544	4688	CMD.exe	128
PID 3476 wrote to memory of 1868	3476	xdwdMicrosoft Dynamics CRM.exe	130
PID 1868 wrote to memory of 4276	1868	CMD.exe	132
PID 4948 wrote to memory of 2968	4948	sea.exe	133
PID 2968 wrote to memory of 4388	2968	CMD.exe	135
PID 3476 wrote to memory of 2924	3476	xdwdMicrosoft Dynamics CRM.exe	136
PID 4948 wrote to memory of 2260	4948	sea.exe	137
PID 2260 wrote to memory of 1936	2260	CMD.exe	139
PID 4948 wrote to memory of 4856	4948	sea.exe	141
PID 4856 wrote to memory of 1820	4856	CMD.exe	143
PID 4948 wrote to memory of 3728	4948	sea.exe	145
PID 3728 wrote to memory of 2524	3728	CMD.exe	147
PID 4948 wrote to memory of 2456	4948	sea.exe	148
PID 2456 wrote to memory of 2928	2456	CMD.exe	150
PID 4948 wrote to memory of 400	4948	sea.exe	151
PID 400 wrote to memory of 1040	400	CMD.exe	153
PID 4948 wrote to memory of 2844	4948	sea.exe	154
PID 2844 wrote to memory of 1476	2844	CMD.exe	156
PID 2924 wrote to memory of 3268	2924	xdwdAdobe Premiere Pro Upgrade.exe	157
PID 3268 wrote to memory of 1368	3268	CMD.exe	159
PID 4948 wrote to memory of 1052	4948	sea.exe	160
PID 1052 wrote to memory of 224	1052	CMD.exe	162
PID 2924 wrote to memory of 1100	2924	xdwdAdobe Premiere Pro Upgrade.exe	163
PID 1100 wrote to memory of 2408	1100	CMD.exe	165
PID 4948 wrote to memory of 1016	4948	sea.exe	166
PID 1016 wrote to memory of 4552	1016	CMD.exe	168
PID 4948 wrote to memory of 4104	4948	sea.exe	169
PID 4104 wrote to memory of 3680	4104	CMD.exe	171
PID 4948 wrote to memory of 2212	4948	sea.exe	172
PID 2212 wrote to memory of 3936	2212	CMD.exe	174
PID 4948 wrote to memory of 3868	4948	sea.exe	175
PID 3868 wrote to memory of 4652	3868	CMD.exe	177
PID 4948 wrote to memory of 1500	4948	sea.exe	178
PID 1500 wrote to memory of 4216	1500	CMD.exe	180
PID 4948 wrote to memory of 4220	4948	sea.exe	181
PID 4220 wrote to memory of 5112	4220	CMD.exe	183
PID 4948 wrote to memory of 4924	4948	sea.exe	184
PID 4924 wrote to memory of 1596	4924	CMD.exe	186
PID 4948 wrote to memory of 3464	4948	sea.exe	187
PID 3464 wrote to memory of 3404	3464	CMD.exe	189
PID 4948 wrote to memory of 968	4948	sea.exe	190
PID 968 wrote to memory of 1468	968	CMD.exe	192
PID 4948 wrote to memory of 220	4948	sea.exe	193
PID 220 wrote to memory of 2896	220	CMD.exe	195
PID 4948 wrote to memory of 3896	4948	sea.exe	196
PID 3896 wrote to memory of 2284	3896	CMD.exe	198
PID 4948 wrote to memory of 2192	4948	sea.exe	199
PID 2192 wrote to memory of 2208	2192	CMD.exe	201
PID 4948 wrote to memory of 3872	4948	sea.exe	202

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sea.exe
"C:\Users\Admin\AppData\Local\Temp\sea.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Revit" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Revit" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Remote Desktop Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Dynamics CRM.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Remote Desktop Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Dynamics CRM.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3292

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Dynamics CRM.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Dynamics CRM.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4276
- C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe
  "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1368
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "7-Zip" /tr "C:\Users\Admin\Documents\xdwdAdobe Premiere Pro Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2408

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4948-0-0x0000000000B00000-0x0000000000B72000-memory.dmp

Download

memory/4948-32-0x000000001BDA0000-0x000000001BDB0000-memory.dmp

Download

memory/4948-73-0x000000001D710000-0x000000001D786000-memory.dmp

Download

memory/4948-74-0x000000001BD90000-0x000000001BD9C000-memory.dmp

Download

memory/4948-75-0x000000001D010000-0x000000001D02E000-memory.dmp

Download

memory/4948-90-0x000000001BDA0000-0x000000001BDB0000-memory.dmp

Download