sheetrat | b4c53a49cab03ef326068030f12e5be22625932bd4b526a62ff7d053bedf8283

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sheet Rat 2.6.exe
Size 421KB
Sample260822-pyj7qavane
SHA256 b4c53a49cab03ef326068030f12e5be22625932bd4b526a62ff7d053bedf8283
MD5 bb3292ae0e8b7a25f6be35b33fd297ad
SHA1 16292b6ccc8938e955f2307c82ad1572fd681f6b
SHA512 d86a02069a4f655584724e1f5614682b7a66429b791e57442b09b351e5187b7f9558f1e5c21396ddaa910b490e3168ed8bf6a0d3cc943e2ea70969a28c1bff80
SSDEEP 6144:aLvZNuh4baGicpe6VlWT8b9e//H6YsYKKkrbFqbsMEQ6:anDBPVle88KKklqbsME
TLSH
T1B394D40CFE92F805CE5A3D73CFE614104B7125C22E259296314AAFFC8B9637658E667C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_ofxkderoxtpc execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_ofxkderoxtpc

august-folder.gl.at.ply.gg:13935

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/1544-0-0x0000000000E70000-0x0000000000EE0000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/1544-0-0x0000000000E70000-0x0000000000EE0000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\xdwdAdobe Acrobat.exe"	Sheet Rat 2.6.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
6044	xdwdAutodesk Revit.exe
3428	xdwdAdobe Acrobat.exe

Loads dropped DLL 54 IoCs

pid	Process
4344	Process not Found
3680	Process not Found
5544	Process not Found
5824	Process not Found
2756	Process not Found
2636	Process not Found
1336	Process not Found
5200	Process not Found
4884	WmiApSrv.exe
3856	Process not Found
3512	Process not Found
6044	xdwdAutodesk Revit.exe
4512	Process not Found
2216	Process not Found
3180	Process not Found
992	Process not Found
2552	Process not Found
1652	Process not Found
456	Process not Found
5760	Process not Found
1664	Process not Found
200	Process not Found
3428	xdwdAdobe Acrobat.exe
1224	Process not Found
888	Process not Found
2492	Process not Found
3136	Process not Found
2560	Process not Found
2224	Process not Found
4220	Process not Found
5156	Process not Found
6056	Process not Found
1956	Process not Found
4816	Process not Found
1864	Process not Found
1344	Process not Found
2344	Process not Found
5828	Process not Found
4296	Process not Found
2396	Process not Found
2272	Process not Found
2368	Process not Found
5380	Process not Found
4196	Process not Found
1628	Process not Found
5220	Process not Found
5332	Process not Found
4864	Process not Found
952	Process not Found
4628	Process not Found
3384	Process not Found
4852	Process not Found
2592	Process not Found
5412	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceSettings = "C:\\Windows\\xdwdAutodesk Revit.exe"	Sheet Rat 2.6.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\xdwdAdobe Acrobat.exe	Sheet Rat 2.6.exe
File opened for modification	C:\Program Files\xdwdAdobe Acrobat.exe	Sheet Rat 2.6.exe
File opened for modification	C:\Program Files\xdwdAdobe Acrobat.exe	xdwdAutodesk Revit.exe
File opened for modification	C:\Program Files\xdwdAdobe Acrobat.exe	xdwdAdobe Acrobat.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwdAutodesk Revit.exe	xdwdAdobe Acrobat.exe
File created	C:\Windows\xdwdAutodesk Revit.exe	Sheet Rat 2.6.exe
File opened for modification	C:\Windows\xdwdAutodesk Revit.exe	Sheet Rat 2.6.exe
File created	C:\Windows\xdwd.dll	Sheet Rat 2.6.exe
File opened for modification	C:\Windows\xdwdAutodesk Revit.exe	xdwdAutodesk Revit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 47 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	CMD.exe
1876	CMD.exe
936	CMD.exe
2468	CMD.exe
3212	CMD.exe
2432	CMD.exe
1480	CMD.exe
3076	CMD.exe
5180	CMD.exe
5252	CMD.exe
3436	CMD.exe
4992	CMD.exe
3376	CMD.exe
1708	CMD.exe
2276	CMD.exe
5740	CMD.exe
2788	CMD.exe
3924	CMD.exe
3504	CMD.exe
5000	CMD.exe
1616	CMD.exe
4620	CMD.exe
5892	CMD.exe
2924	CMD.exe
2692	CMD.exe
5964	CMD.exe
4536	CMD.exe
1872	CMD.exe
6080	CMD.exe
1920	CMD.exe
4452	CMD.exe
5596	CMD.exe
2348	CMD.exe
4996	CMD.exe
5856	CMD.exe
1868	CMD.exe
5956	CMD.exe
896	CMD.exe
2712	CMD.exe
2224	CMD.exe
4548	CMD.exe
3248	CMD.exe
3692	CMD.exe
4688	CMD.exe
4840	CMD.exe
2728	CMD.exe
1172	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3464	schtasks.exe
3764	schtasks.exe
3312	schtasks.exe
3320	schtasks.exe
4100	schtasks.exe
5180	schtasks.exe
768	schtasks.exe
4276	schtasks.exe
6116	schtasks.exe
5780	schtasks.exe
3216	schtasks.exe
1600	schtasks.exe
4984	schtasks.exe
4412	schtasks.exe
4156	schtasks.exe
2332	schtasks.exe
2712	schtasks.exe
4508	schtasks.exe
5528	schtasks.exe
2908	schtasks.exe
1116	schtasks.exe
4136	schtasks.exe
2868	schtasks.exe
1696	schtasks.exe
3108	schtasks.exe
1704	schtasks.exe
2184	schtasks.exe
2708	schtasks.exe
5708	schtasks.exe
2308	schtasks.exe
5984	schtasks.exe
3596	schtasks.exe
2324	schtasks.exe
3152	schtasks.exe
3444	schtasks.exe
4328	schtasks.exe
4464	schtasks.exe
3288	schtasks.exe
3388	schtasks.exe
1440	schtasks.exe
4172	schtasks.exe
6040	schtasks.exe
1324	schtasks.exe
6040	schtasks.exe
1864	schtasks.exe
5548	schtasks.exe
1268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
1544	Sheet Rat 2.6.exe
4884	WmiApSrv.exe
4884	WmiApSrv.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe
6044	xdwdAutodesk Revit.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	Sheet Rat 2.6.exe
Token: SeDebugPrivilege	6044	xdwdAutodesk Revit.exe
Token: SeDebugPrivilege	3428	xdwdAdobe Acrobat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1876	1544	Sheet Rat 2.6.exe	90
PID 1876 wrote to memory of 3216	1876	CMD.exe	92
PID 1544 wrote to memory of 936	1544	Sheet Rat 2.6.exe	93
PID 936 wrote to memory of 1324	936	CMD.exe	95
PID 1544 wrote to memory of 1872	1544	Sheet Rat 2.6.exe	96
PID 1872 wrote to memory of 3108	1872	CMD.exe	98
PID 1544 wrote to memory of 6080	1544	Sheet Rat 2.6.exe	104
PID 6080 wrote to memory of 1704	6080	CMD.exe	106
PID 1544 wrote to memory of 4992	1544	Sheet Rat 2.6.exe	107
PID 4992 wrote to memory of 3320	4992	CMD.exe	109
PID 1544 wrote to memory of 4548	1544	Sheet Rat 2.6.exe	112
PID 4548 wrote to memory of 6040	4548	CMD.exe	114
PID 1544 wrote to memory of 3248	1544	Sheet Rat 2.6.exe	117
PID 3248 wrote to memory of 4156	3248	CMD.exe	119
PID 1544 wrote to memory of 5000	1544	Sheet Rat 2.6.exe	120
PID 5000 wrote to memory of 1864	5000	CMD.exe	122
PID 1544 wrote to memory of 3376	1544	Sheet Rat 2.6.exe	123
PID 3376 wrote to memory of 1600	3376	CMD.exe	125
PID 1544 wrote to memory of 1868	1544	Sheet Rat 2.6.exe	126
PID 1868 wrote to memory of 4984	1868	CMD.exe	128
PID 1544 wrote to memory of 1172	1544	Sheet Rat 2.6.exe	129
PID 1172 wrote to memory of 4100	1172	CMD.exe	131
PID 6044 wrote to memory of 1616	6044	xdwdAutodesk Revit.exe	132
PID 1616 wrote to memory of 3596	1616	CMD.exe	134
PID 1544 wrote to memory of 4620	1544	Sheet Rat 2.6.exe	135
PID 4620 wrote to memory of 2184	4620	CMD.exe	137
PID 1544 wrote to memory of 5892	1544	Sheet Rat 2.6.exe	138
PID 5892 wrote to memory of 2708	5892	CMD.exe	140
PID 1544 wrote to memory of 1708	1544	Sheet Rat 2.6.exe	141
PID 1708 wrote to memory of 5708	1708	CMD.exe	143
PID 1544 wrote to memory of 5252	1544	Sheet Rat 2.6.exe	144
PID 5252 wrote to memory of 3388	5252	CMD.exe	146
PID 6044 wrote to memory of 3428	6044	xdwdAutodesk Revit.exe	147
PID 1544 wrote to memory of 2468	1544	Sheet Rat 2.6.exe	148
PID 2468 wrote to memory of 5180	2468	CMD.exe	150
PID 1544 wrote to memory of 1920	1544	Sheet Rat 2.6.exe	151
PID 1920 wrote to memory of 768	1920	CMD.exe	153
PID 1544 wrote to memory of 4452	1544	Sheet Rat 2.6.exe	154
PID 4452 wrote to memory of 2712	4452	CMD.exe	156
PID 1544 wrote to memory of 2276	1544	Sheet Rat 2.6.exe	157
PID 2276 wrote to memory of 1440	2276	CMD.exe	159
PID 1544 wrote to memory of 4288	1544	Sheet Rat 2.6.exe	160
PID 4288 wrote to memory of 2324	4288	CMD.exe	162
PID 3428 wrote to memory of 2924	3428	xdwdAdobe Acrobat.exe	163
PID 2924 wrote to memory of 2308	2924	CMD.exe	165
PID 1544 wrote to memory of 5740	1544	Sheet Rat 2.6.exe	166
PID 5740 wrote to memory of 5548	5740	CMD.exe	168
PID 3428 wrote to memory of 2692	3428	xdwdAdobe Acrobat.exe	169
PID 2692 wrote to memory of 4276	2692	CMD.exe	171
PID 1544 wrote to memory of 5956	1544	Sheet Rat 2.6.exe	172
PID 5956 wrote to memory of 1696	5956	CMD.exe	174
PID 1544 wrote to memory of 2788	1544	Sheet Rat 2.6.exe	175
PID 2788 wrote to memory of 1268	2788	CMD.exe	177
PID 1544 wrote to memory of 3924	1544	Sheet Rat 2.6.exe	178
PID 3924 wrote to memory of 4172	3924	CMD.exe	180
PID 1544 wrote to memory of 3212	1544	Sheet Rat 2.6.exe	181
PID 3212 wrote to memory of 3312	3212	CMD.exe	183
PID 1544 wrote to memory of 2432	1544	Sheet Rat 2.6.exe	184
PID 2432 wrote to memory of 3152	2432	CMD.exe	186
PID 1544 wrote to memory of 3504	1544	Sheet Rat 2.6.exe	187
PID 3504 wrote to memory of 3444	3504	CMD.exe	189
PID 1544 wrote to memory of 3692	1544	Sheet Rat 2.6.exe	190
PID 3692 wrote to memory of 4328	3692	CMD.exe	192
PID 1544 wrote to memory of 4688	1544	Sheet Rat 2.6.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Sheet Rat 2.6.exe
"C:\Users\Admin\AppData\Local\Temp\Sheet Rat 2.6.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "VirtualBox" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "VirtualBox" /tr "C:\Program Files\xdwdAdobe Acrobat.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Audacity" /tr "C:\Windows\xdwdAutodesk Revit.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Audacity" /tr "C:\Windows\xdwdAutodesk Revit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6040

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4884

C:\Windows\xdwdAutodesk Revit.exe
"C:\Windows\xdwdAutodesk Revit.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3596
- C:\Program Files\xdwdAdobe Acrobat.exe
  "C:\Program Files\xdwdAdobe Acrobat.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2308
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Program Files\xdwdAdobe Acrobat.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1544-0-0x0000000000E70000-0x0000000000EE0000-memory.dmp

Download

memory/1544-1-0x00007FF8CFE3F000-0x00007FF8CFE40000-memory.dmp

Download

memory/1544-2-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1544-3-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1544-4-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1544-5-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1544-6-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1544-38-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1544-129-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download