sheetrat | ec1744b217ec42dcc660c368acbe4545aa786946bb1983a16ef3ae64d5feea82

Analysis

max time kernel
150s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Starter.exe
Size 557KB
Sample260925-ttt9ca1bmf
SHA256 ec1744b217ec42dcc660c368acbe4545aa786946bb1983a16ef3ae64d5feea82
MD5 83441374984b6c74861b1f25e82c0d04
SHA1 d49e951963dcc65776004406f2bb144d405c94ef
SHA512 7e7b8c67fd05ecb429393fc230b8138e3db70f1274bdd875fd150f1ac9ad8e889c9e38cfcce72cb646baa7b1a9178b657288faa1cd8a684f667b0843b925354d
SSDEEP 6144:DO6uRVsh3z+W1sHb6wfutSje6VlWT8b97SHm4JYelFRbsel/QnmN:DO6mV6gH+wPPVle8TESelQnm
TLSH
T19DC4C31CFE81E804DE1A3CB7CEE915101B7161C1BE119646310AAFFE8B663B359E667C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_yqdwqhqquwnotn credential_access discovery execution sheetrat persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_yqdwqhqquwnotn

decision-38229.portmap.host:38229

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3696-0-0x0000000000D10000-0x0000000000DA2000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/3696-0-0x0000000000D10000-0x0000000000DA2000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\%77Client.exe"	Starter.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
3928	xdwdUnreal Engine.exe
2472	%77Client.exe

Loads dropped DLL 50 IoCs

pid	Process
3920	Process not Found
3284	Process not Found
5148	Process not Found
5388	Process not Found
2784	svchost.exe
4352	Process not Found
6012	Process not Found
4508	Process not Found
3928	xdwdUnreal Engine.exe
3768	Process not Found
2860	Process not Found
4716	Process not Found
5144	Process not Found
2624	Process not Found
5384	Process not Found
1244	Process not Found
4524	Process not Found
5984	Process not Found
5376	Process not Found
2472	%77Client.exe
4264	Process not Found
2536	Process not Found
2312	Process not Found
4996	Process not Found
1716	Process not Found
3676	Process not Found
4804	Process not Found
5568	Process not Found
2740	Process not Found
2488	Process not Found
3748	Process not Found
2148	Process not Found
2012	Process not Found
5476	Process not Found
4244	Process not Found
3700	Process not Found
3192	Process not Found
3408	Process not Found
4308	Process not Found
1244	Process not Found
3340	Process not Found
4524	Process not Found
552	Process not Found
5528	Process not Found
2936	Process not Found
1084	Process not Found
5148	Process not Found
1928	Process not Found
6032	Process not Found
4228	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\xdwdUnreal Engine.exe"	Starter.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Starter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 47 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1052	CMD.exe
3480	CMD.exe
4564	CMD.exe
4232	CMD.exe
4488	CMD.exe
4248	CMD.exe
1332	CMD.exe
1696	CMD.exe
1556	CMD.exe
828	CMD.exe
3244	CMD.exe
4376	CMD.exe
2124	CMD.exe
3372	CMD.exe
1388	CMD.exe
4976	CMD.exe
5264	CMD.exe
3220	CMD.exe
2436	CMD.exe
4676	CMD.exe
5020	CMD.exe
2432	CMD.exe
5996	CMD.exe
5720	CMD.exe
1448	CMD.exe
4352	CMD.exe
5468	CMD.exe
464	CMD.exe
3536	CMD.exe
3008	CMD.exe
4296	CMD.exe
5092	CMD.exe
5168	CMD.exe
3692	CMD.exe
3544	CMD.exe
5736	CMD.exe
2468	CMD.exe
3052	CMD.exe
4124	CMD.exe
2420	CMD.exe
3180	CMD.exe
5888	CMD.exe
1300	CMD.exe
3212	CMD.exe
4764	CMD.exe
3264	CMD.exe
3056	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdUnreal Engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	%77Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	%77Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Starter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Starter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdUnreal Engine.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1356	schtasks.exe
2580	schtasks.exe
5868	schtasks.exe
2616	schtasks.exe
1780	schtasks.exe
3416	schtasks.exe
5624	schtasks.exe
5368	schtasks.exe
5624	schtasks.exe
6064	schtasks.exe
5256	schtasks.exe
4528	schtasks.exe
3500	schtasks.exe
1356	schtasks.exe
5576	schtasks.exe
5824	schtasks.exe
1080	schtasks.exe
1408	schtasks.exe
5008	schtasks.exe
4960	schtasks.exe
5052	schtasks.exe
1464	schtasks.exe
4728	schtasks.exe
2720	schtasks.exe
2780	schtasks.exe
5556	schtasks.exe
2540	schtasks.exe
5860	schtasks.exe
2628	schtasks.exe
5392	schtasks.exe
4120	schtasks.exe
5808	schtasks.exe
3284	schtasks.exe
1048	schtasks.exe
4192	schtasks.exe
4252	schtasks.exe
5000	schtasks.exe
4192	schtasks.exe
2924	schtasks.exe
4508	schtasks.exe
4340	schtasks.exe
2680	schtasks.exe
5812	schtasks.exe
1880	schtasks.exe
3392	schtasks.exe
2688	schtasks.exe
2204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
2784	svchost.exe
2784	svchost.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe
3696	Starter.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	Starter.exe
Token: SeDebugPrivilege	3928	xdwdUnreal Engine.exe
Token: SeDebugPrivilege	2472	%77Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 2432	3696	Starter.exe	90
PID 2432 wrote to memory of 4728	2432	CMD.exe	92
PID 3696 wrote to memory of 1696	3696	Starter.exe	93
PID 1696 wrote to memory of 1780	1696	CMD.exe	95
PID 3696 wrote to memory of 3372	3696	Starter.exe	97
PID 3372 wrote to memory of 3416	3372	CMD.exe	99
PID 3696 wrote to memory of 2420	3696	Starter.exe	100
PID 2420 wrote to memory of 2720	2420	CMD.exe	102
PID 3696 wrote to memory of 1388	3696	Starter.exe	106
PID 1388 wrote to memory of 4252	1388	CMD.exe	108
PID 3696 wrote to memory of 5996	3696	Starter.exe	109
PID 5996 wrote to memory of 2780	5996	CMD.exe	111
PID 3696 wrote to memory of 3056	3696	Starter.exe	112
PID 3056 wrote to memory of 5812	3056	CMD.exe	114
PID 3696 wrote to memory of 4976	3696	Starter.exe	117
PID 4976 wrote to memory of 1880	4976	CMD.exe	119
PID 3696 wrote to memory of 1052	3696	Starter.exe	120
PID 1052 wrote to memory of 5624	1052	CMD.exe	122
PID 3696 wrote to memory of 5264	3696	Starter.exe	123
PID 5264 wrote to memory of 4960	5264	CMD.exe	125
PID 3696 wrote to memory of 1556	3696	Starter.exe	126
PID 1556 wrote to memory of 5000	1556	CMD.exe	128
PID 3696 wrote to memory of 3480	3696	Starter.exe	129
PID 3480 wrote to memory of 4528	3480	CMD.exe	131
PID 3928 wrote to memory of 3180	3928	xdwdUnreal Engine.exe	132
PID 3180 wrote to memory of 2616	3180	CMD.exe	134
PID 3696 wrote to memory of 5888	3696	Starter.exe	135
PID 5888 wrote to memory of 1464	5888	CMD.exe	137
PID 3696 wrote to memory of 4564	3696	Starter.exe	138
PID 4564 wrote to memory of 3392	4564	CMD.exe	140
PID 3696 wrote to memory of 4232	3696	Starter.exe	141
PID 4232 wrote to memory of 3500	4232	CMD.exe	143
PID 3696 wrote to memory of 3220	3696	Starter.exe	144
PID 3220 wrote to memory of 1356	3220	CMD.exe	146
PID 3928 wrote to memory of 2472	3928	xdwdUnreal Engine.exe	147
PID 3696 wrote to memory of 4488	3696	Starter.exe	148
PID 4488 wrote to memory of 4192	4488	CMD.exe	150
PID 3696 wrote to memory of 2436	3696	Starter.exe	151
PID 2436 wrote to memory of 5556	2436	CMD.exe	153
PID 3696 wrote to memory of 1300	3696	Starter.exe	154
PID 1300 wrote to memory of 2540	1300	CMD.exe	156
PID 3696 wrote to memory of 3212	3696	Starter.exe	157
PID 3212 wrote to memory of 5392	3212	CMD.exe	159
PID 3696 wrote to memory of 5720	3696	Starter.exe	160
PID 5720 wrote to memory of 2924	5720	CMD.exe	162
PID 2472 wrote to memory of 464	2472	%77Client.exe	163
PID 464 wrote to memory of 5368	464	CMD.exe	165
PID 2472 wrote to memory of 4124	2472	%77Client.exe	166
PID 4124 wrote to memory of 5576	4124	CMD.exe	168
PID 3696 wrote to memory of 828	3696	Starter.exe	169
PID 828 wrote to memory of 4508	828	CMD.exe	171
PID 2472 wrote to memory of 3244	2472	%77Client.exe	172
PID 3244 wrote to memory of 5052	3244	CMD.exe	174
PID 3696 wrote to memory of 3536	3696	Starter.exe	175
PID 3536 wrote to memory of 4340	3536	CMD.exe	177
PID 3696 wrote to memory of 5168	3696	Starter.exe	178
PID 5168 wrote to memory of 4120	5168	CMD.exe	180
PID 3696 wrote to memory of 4376	3696	Starter.exe	181
PID 4376 wrote to memory of 5860	4376	CMD.exe	183
PID 3696 wrote to memory of 3692	3696	Starter.exe	184
PID 3692 wrote to memory of 5624	3692	CMD.exe	186
PID 3696 wrote to memory of 4248	3696	Starter.exe	187
PID 3696 wrote to memory of 4676	3696	Starter.exe	190
PID 4676 wrote to memory of 2628	4676	CMD.exe	192

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Starter.exe
"C:\Users\Admin\AppData\Local\Temp\Starter.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Project" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Project" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Dropbox" /tr "C:\Users\Admin\AppData\Roaming\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Dropbox" /tr "C:\Users\Admin\AppData\Roaming\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2784

C:\Users\Admin\AppData\Roaming\xdwdUnreal Engine.exe
"C:\Users\Admin\AppData\Roaming\xdwdUnreal Engine.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- C:\Users\Admin\AppData\Roaming\%77Client.exe
  "C:\Users\Admin\AppData\Roaming\%77Client.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5368
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5576
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Greenshot" /tr "C:\Users\Admin\AppData\Roaming\%77Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3696-6-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-2-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-3-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-4-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-5-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-0-0x0000000000D10000-0x0000000000DA2000-memory.dmp

Download

memory/3696-7-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-8-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-9-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-10-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-49-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download

memory/3696-1-0x00007FF8C1CCF000-0x00007FF8C1CD0000-memory.dmp

Download

memory/3696-131-0x00007FF8C1B40000-0x00007FF8C24E4000-memory.dmp

Download