sheetrat | 36e8094f9535b265fbee14f2a0de58cf67d2edb45487352f0ac062edf0e9d6e3

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/09/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 369KB
Sample260925-mntmasdd95
SHA256 36e8094f9535b265fbee14f2a0de58cf67d2edb45487352f0ac062edf0e9d6e3
MD5 70c2f49ab1088e5268f9477467c5b049
SHA1 b246659aac0e3851140482f8ca7b9d1abdcd0a1e
SHA512 cd5ac2f123f097ab36544ba2d9fd44ba397dc116fb9f19127fe34fa8fe78d45a360c6c7f251ac1eaee6fd23bbec0dabe0cb65b918d67c2ddd1a273331c6c4ba1
SSDEEP 6144:7WfElXQzTtog25NJ71N8qQAe6VlWT8b9LiTOPmvBR/qb4F2S55:7WAXiTtog2XJJBPVle8FHmv3D1v
TLSH
T12284B30CFE91E845DD2A3D77CFF610044BB122C22E22925732496FFD8B6537658A66BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_yymbzlzfhaixwnf execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_yymbzlzfhaixwnf

bore.pub:13434

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/1116-0-0x0000000000810000-0x0000000000872000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/1116-0-0x0000000000810000-0x0000000000872000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Public\\Pictures\\xdwdCorelDRAW.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
4044	xdwdAtom.exe
5828	xdwdCorelDRAW.exe

Loads dropped DLL 58 IoCs

pid	Process
896	Process not Found
2800	Process not Found
4404	Process not Found
4044	xdwdAtom.exe
5828	xdwdCorelDRAW.exe
3948	Process not Found
5392	Process not Found
588	WmiApSrv.exe
5660	Process not Found
3408	Process not Found
2940	Process not Found
4672	Process not Found
4076	Process not Found
3808	Process not Found
1852	Process not Found
5416	Process not Found
6132	Process not Found
2004	Process not Found
2548	Process not Found
2796	Process not Found
220	Process not Found
1084	Process not Found
5992	Process not Found
1164	Process not Found
3152	Process not Found
3828	Process not Found
4632	Process not Found
3264	Process not Found
2272	Process not Found
3008	Process not Found
5780	Process not Found
2828	Process not Found
5680	Process not Found
5504	Process not Found
6112	Process not Found
3572	svchost.exe
4968	Process not Found
4584	Process not Found
2104	Process not Found
6100	Process not Found
2284	Process not Found
5152	Process not Found
2072	Process not Found
2324	taskmgr.exe
5896	Process not Found
3376	Process not Found
2836	Process not Found
4832	Process not Found
4528	Process not Found
5260	Process not Found
4632	Process not Found
1264	Process not Found
2404	Process not Found
1612	Process not Found
5064	Process not Found
3448	Process not Found
4312	Process not Found
1804	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Executes a command shell one-liner 1 TTPs 48 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5540	CMD.exe
5480	CMD.exe
3664	CMD.exe
932	CMD.exe
3972	CMD.exe
1068	CMD.exe
1832	CMD.exe
4744	CMD.exe
5720	CMD.exe
1620	CMD.exe
5344	CMD.exe
4768	CMD.exe
3984	CMD.exe
2824	CMD.exe
2284	CMD.exe
5432	CMD.exe
3944	CMD.exe
348	CMD.exe
5776	CMD.exe
2944	CMD.exe
4588	CMD.exe
5020	CMD.exe
3092	CMD.exe
5032	CMD.exe
5132	CMD.exe
2420	CMD.exe
572	CMD.exe
4232	CMD.exe
2176	CMD.exe
5220	CMD.exe
5868	CMD.exe
2356	CMD.exe
5324	CMD.exe
2184	CMD.exe
5304	CMD.exe
5100	CMD.exe
2388	CMD.exe
2476	CMD.exe
1872	CMD.exe
5108	CMD.exe
4912	CMD.exe
2916	CMD.exe
1124	CMD.exe
4372	CMD.exe
4488	CMD.exe
3988	CMD.exe
5284	CMD.exe
2984	CMD.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3032	schtasks.exe
1576	schtasks.exe
4868	schtasks.exe
5988	schtasks.exe
6032	schtasks.exe
1600	schtasks.exe
4008	schtasks.exe
5672	schtasks.exe
2388	schtasks.exe
1180	schtasks.exe
1796	schtasks.exe
5228	schtasks.exe
3316	schtasks.exe
4824	schtasks.exe
4440	schtasks.exe
5136	schtasks.exe
5424	schtasks.exe
5152	schtasks.exe
2028	schtasks.exe
3252	schtasks.exe
1644	schtasks.exe
4124	schtasks.exe
5860	schtasks.exe
4148	schtasks.exe
5668	schtasks.exe
5492	schtasks.exe
2872	schtasks.exe
2908	schtasks.exe
6100	schtasks.exe
3160	schtasks.exe
1240	schtasks.exe
1884	schtasks.exe
5684	schtasks.exe
5280	schtasks.exe
4688	schtasks.exe
1376	schtasks.exe
5756	schtasks.exe
4664	schtasks.exe
4868	schtasks.exe
5528	schtasks.exe
1472	schtasks.exe
1884	schtasks.exe
1804	schtasks.exe
4704	schtasks.exe
784	schtasks.exe
1564	schtasks.exe
1628	schtasks.exe
5564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
1116	Client.exe
588	WmiApSrv.exe
588	WmiApSrv.exe
4044	xdwdAtom.exe
4044	xdwdAtom.exe
4044	xdwdAtom.exe
4044	xdwdAtom.exe
4044	xdwdAtom.exe
3572	svchost.exe
3572	svchost.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	Client.exe
Token: SeDebugPrivilege	4044	xdwdAtom.exe
Token: SeDebugPrivilege	5828	xdwdCorelDRAW.exe
Token: SeDebugPrivilege	2324	taskmgr.exe
Token: SeSystemProfilePrivilege	2324	taskmgr.exe
Token: SeCreateGlobalPrivilege	2324	taskmgr.exe
Token: SeSecurityPrivilege	2324	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2324	taskmgr.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 5540	1116	Client.exe	81
PID 5540 wrote to memory of 4868	5540	CMD.exe	83
PID 1116 wrote to memory of 5432	1116	Client.exe	84
PID 5432 wrote to memory of 5280	5432	CMD.exe	86
PID 1116 wrote to memory of 5132	1116	Client.exe	87
PID 5132 wrote to memory of 5136	5132	CMD.exe	89
PID 1116 wrote to memory of 5480	1116	Client.exe	95
PID 5480 wrote to memory of 2872	5480	CMD.exe	97
PID 1116 wrote to memory of 3944	1116	Client.exe	100
PID 3944 wrote to memory of 5424	3944	CMD.exe	102
PID 1116 wrote to memory of 2916	1116	Client.exe	103
PID 2916 wrote to memory of 2908	2916	CMD.exe	105
PID 1116 wrote to memory of 1124	1116	Client.exe	106
PID 1124 wrote to memory of 5672	1124	CMD.exe	108
PID 4044 wrote to memory of 5324	4044	xdwdAtom.exe	109
PID 5324 wrote to memory of 1564	5324	CMD.exe	111
PID 1116 wrote to memory of 2420	1116	Client.exe	112
PID 2420 wrote to memory of 6100	2420	CMD.exe	114
PID 5828 wrote to memory of 572	5828	xdwdCorelDRAW.exe	115
PID 572 wrote to memory of 2388	572	CMD.exe	117
PID 1116 wrote to memory of 3664	1116	Client.exe	118
PID 3664 wrote to memory of 1180	3664	CMD.exe	120
PID 5828 wrote to memory of 2184	5828	xdwdCorelDRAW.exe	121
PID 2184 wrote to memory of 5152	2184	CMD.exe	123
PID 1116 wrote to memory of 4372	1116	Client.exe	124
PID 4372 wrote to memory of 5988	4372	CMD.exe	126
PID 1116 wrote to memory of 4488	1116	Client.exe	127
PID 4488 wrote to memory of 4688	4488	CMD.exe	129
PID 1116 wrote to memory of 5720	1116	Client.exe	130
PID 5720 wrote to memory of 1796	5720	CMD.exe	132
PID 1116 wrote to memory of 348	1116	Client.exe	133
PID 348 wrote to memory of 6032	348	CMD.exe	135
PID 1116 wrote to memory of 3984	1116	Client.exe	136
PID 3984 wrote to memory of 5860	3984	CMD.exe	138
PID 1116 wrote to memory of 5776	1116	Client.exe	139
PID 5776 wrote to memory of 2028	5776	CMD.exe	141
PID 1116 wrote to memory of 4232	1116	Client.exe	142
PID 4232 wrote to memory of 1376	4232	CMD.exe	144
PID 1116 wrote to memory of 3988	1116	Client.exe	145
PID 3988 wrote to memory of 1600	3988	CMD.exe	147
PID 1116 wrote to memory of 2176	1116	Client.exe	148
PID 2176 wrote to memory of 3160	2176	CMD.exe	150
PID 1116 wrote to memory of 5284	1116	Client.exe	151
PID 5284 wrote to memory of 1884	5284	CMD.exe	153
PID 1116 wrote to memory of 2984	1116	Client.exe	154
PID 2984 wrote to memory of 3252	2984	CMD.exe	156
PID 1116 wrote to memory of 2944	1116	Client.exe	157
PID 2944 wrote to memory of 4148	2944	CMD.exe	159
PID 1116 wrote to memory of 3092	1116	Client.exe	160
PID 3092 wrote to memory of 1628	3092	CMD.exe	162
PID 1116 wrote to memory of 4912	1116	Client.exe	163
PID 4912 wrote to memory of 1804	4912	CMD.exe	165
PID 1116 wrote to memory of 5020	1116	Client.exe	166
PID 5020 wrote to memory of 1240	5020	CMD.exe	168
PID 1116 wrote to memory of 2824	1116	Client.exe	169
PID 2824 wrote to memory of 1576	2824	CMD.exe	171
PID 1116 wrote to memory of 5304	1116	Client.exe	172
PID 5304 wrote to memory of 5756	5304	CMD.exe	174
PID 1116 wrote to memory of 5100	1116	Client.exe	179
PID 5100 wrote to memory of 5228	5100	CMD.exe	182
PID 1116 wrote to memory of 932	1116	Client.exe	183
PID 932 wrote to memory of 4664	932	CMD.exe	185
PID 1116 wrote to memory of 2388	1116	Client.exe	186
PID 2388 wrote to memory of 4704	2388	CMD.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "TeamViewer" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "TeamViewer" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "CCleaner" /tr "C:\Users\Admin\AppData\Roaming\xdwdAtom.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "CCleaner" /tr "C:\Users\Admin\AppData\Roaming\xdwdAtom.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4148
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2284
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4440

C:\Users\Admin\AppData\Roaming\xdwdAtom.exe
C:\Users\Admin\AppData\Roaming\xdwdAtom.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1564

C:\Users\Public\Pictures\xdwdCorelDRAW.exe
C:\Users\Public\Pictures\xdwdCorelDRAW.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "VLC Media Player" /tr "C:\Users\Public\Pictures\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5152

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-0-0x0000000000810000-0x0000000000872000-memory.dmp

Download

memory/1116-32-0x000000001C8E0000-0x000000001C8F0000-memory.dmp

Download

memory/1116-49-0x000000001C8E0000-0x000000001C8F0000-memory.dmp

Download

memory/1116-72-0x0000000002B40000-0x0000000002B5E000-memory.dmp

Download

memory/1116-71-0x000000001CDF0000-0x000000001CF36000-memory.dmp

Download

memory/1116-70-0x000000001CD70000-0x000000001CDE6000-memory.dmp

Download

memory/2324-90-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-91-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-89-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-101-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-100-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-99-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-98-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-97-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-96-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download

memory/2324-95-0x000001F5B7140000-0x000001F5B7141000-memory.dmp

Download