sheetrat | 2b2b2543eeb29a31f989e09a84717176ee8bebad7f31a7e02d1606c7381db854

Analysis

max time kernel
300s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 549KB
Sample261018-nc13nsae67
SHA256 2b2b2543eeb29a31f989e09a84717176ee8bebad7f31a7e02d1606c7381db854
MD5 a3cfdef3c5fede25bc7a644ca837ce54
SHA1 fd7d2fa2d0a7a161d0a017846fd86434a6938e53
SHA512 63fd4ae8567626c7df5511732eae40a5a915b6a6fdbdf5348b7eacaed3642cb28cc42069f3ddfc942ed798ec02d0062c5436dc73b9ecfacc1ffd53a45872c8c7
SSDEEP 12288:bbag6zxRDaMePVle8ZB4bD9XU1hxyN/3X:bbaNxRDbaOpU1EX
TLSH
T1D2C4B51DFE81F809DE2A3E73CFE920145B7121C16E22924621596FFD87663B358E267C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_nbszmiyxtax discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_nbszmiyxtax

t82vhiny4s.localto.net:3153

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3936-0-0x00000000004E0000-0x0000000000570000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/3936-0-0x00000000004E0000-0x0000000000570000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\xdwdWireshark Host.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 64 IoCs

pid	Process
4764	Process not Found
1052	Process not Found
2168	Process not Found
5824	Process not Found
2380	Process not Found
4128	Process not Found
5352	WmiApSrv.exe
5160	Process not Found
764	Process not Found
1432	Process not Found
2484	Process not Found
3052	Process not Found
4932	Process not Found
5800	Process not Found
4116	Process not Found
2688	Process not Found
2840	Process not Found
5760	Process not Found
692	Process not Found
1416	Process not Found
6084	Process not Found
1820	Process not Found
3136	Process not Found
5216	Process not Found
1444	Process not Found
5348	Process not Found
6056	Process not Found
2820	Process not Found
8	Process not Found
5904	Process not Found
3148	Process not Found
4812	Process not Found
2636	Process not Found
4788	Process not Found
5448	Process not Found
1508	Process not Found
3168	Process not Found
4692	Process not Found
1976	Process not Found
4440	Process not Found
4332	Process not Found
4412	Process not Found
5076	Process not Found
4668	Process not Found
4276	Process not Found
5164	Process not Found
4880	Process not Found
264	Process not Found
1976	Process not Found
2788	Process not Found
4052	Process not Found
2812	Process not Found
5560	Process not Found
1556	Process not Found
4600	Process not Found
5448	Process not Found
2476	Process not Found
1936	Process not Found
3128	Process not Found
4924	Process not Found
3508	Process not Found
2676	Process not Found
900	Process not Found
1348	Process not Found

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
10	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\xdwdWireshark Host.exe	Client.exe
File opened for modification	C:\Program Files\xdwdWireshark Host.exe	Client.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5932	CMD.exe
3428	CMD.exe
1972	CMD.exe
5376	CMD.exe
1440	CMD.exe
4520	CMD.exe
3680	CMD.exe
4316	CMD.exe
3688	CMD.exe
1640	CMD.exe
1820	CMD.exe
2956	CMD.exe
4000	CMD.exe
5780	CMD.exe
4216	CMD.exe
5868	CMD.exe
2772	CMD.exe
6100	CMD.exe
4972	CMD.exe
2212	CMD.exe
3632	CMD.exe
5208	CMD.exe
3112	CMD.exe
2880	CMD.exe
1652	CMD.exe
1864	CMD.exe
4948	CMD.exe
2708	CMD.exe
2728	CMD.exe
5572	CMD.exe
5508	CMD.exe
2688	CMD.exe
4024	CMD.exe
4220	CMD.exe
5244	CMD.exe
3240	CMD.exe
3948	CMD.exe
5740	CMD.exe
4088	CMD.exe
3140	CMD.exe
3260	CMD.exe
5404	CMD.exe
4992	CMD.exe
3872	CMD.exe
3280	CMD.exe
4904	CMD.exe
4460	CMD.exe
3380	CMD.exe
3456	CMD.exe
3304	CMD.exe
3988	CMD.exe
5960	CMD.exe
4500	CMD.exe
4548	CMD.exe
4488	CMD.exe
4852	CMD.exe
3208	CMD.exe
5588	CMD.exe
2844	CMD.exe
2620	CMD.exe
4652	CMD.exe
2336	CMD.exe
3232	CMD.exe
4076	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2084	schtasks.exe
4752	schtasks.exe
3408	schtasks.exe
5108	schtasks.exe
692	schtasks.exe
2620	schtasks.exe
5440	schtasks.exe
5344	schtasks.exe
5780	schtasks.exe
5768	schtasks.exe
384	schtasks.exe
3640	schtasks.exe
4472	schtasks.exe
2152	schtasks.exe
924	schtasks.exe
1920	schtasks.exe
3240	schtasks.exe
5408	schtasks.exe
5400	schtasks.exe
5108	schtasks.exe
5844	schtasks.exe
5344	schtasks.exe
2800	schtasks.exe
3776	schtasks.exe
3968	schtasks.exe
1916	schtasks.exe
5800	schtasks.exe
4644	schtasks.exe
5980	schtasks.exe
4060	schtasks.exe
1696	schtasks.exe
3684	schtasks.exe
2380	schtasks.exe
1108	schtasks.exe
3492	schtasks.exe
1820	schtasks.exe
4972	schtasks.exe
4572	schtasks.exe
5352	schtasks.exe
4152	schtasks.exe
2212	schtasks.exe
2752	schtasks.exe
1812	schtasks.exe
3428	schtasks.exe
2800	schtasks.exe
5036	schtasks.exe
852	schtasks.exe
1928	schtasks.exe
5928	schtasks.exe
3684	schtasks.exe
3416	schtasks.exe
1356	schtasks.exe
3452	schtasks.exe
5232	schtasks.exe
2028	schtasks.exe
5544	schtasks.exe
6128	schtasks.exe
4496	schtasks.exe
4664	schtasks.exe
6040	schtasks.exe
4488	schtasks.exe
5600	schtasks.exe
1812	schtasks.exe
4384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
5352	WmiApSrv.exe
5352	WmiApSrv.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe
3936	Client.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 2464	3936	Client.exe	90
PID 2464 wrote to memory of 5980	2464	CMD.exe	92
PID 3936 wrote to memory of 3368	3936	Client.exe	93
PID 3368 wrote to memory of 4488	3368	CMD.exe	96
PID 3936 wrote to memory of 2728	3936	Client.exe	97
PID 2728 wrote to memory of 1820	2728	CMD.exe	99
PID 3936 wrote to memory of 2772	3936	Client.exe	101
PID 2772 wrote to memory of 852	2772	CMD.exe	103
PID 3936 wrote to memory of 4852	3936	Client.exe	106
PID 4852 wrote to memory of 4972	4852	CMD.exe	108
PID 3936 wrote to memory of 5676	3936	Client.exe	111
PID 5676 wrote to memory of 2620	5676	CMD.exe	113
PID 3936 wrote to memory of 5572	3936	Client.exe	116
PID 5572 wrote to memory of 5320	5572	CMD.exe	118
PID 3936 wrote to memory of 4688	3936	Client.exe	119
PID 4688 wrote to memory of 2844	4688	CMD.exe	121
PID 3936 wrote to memory of 6100	3936	Client.exe	122
PID 6100 wrote to memory of 4572	6100	CMD.exe	124
PID 3936 wrote to memory of 2912	3936	Client.exe	125
PID 2912 wrote to memory of 4060	2912	CMD.exe	127
PID 3936 wrote to memory of 1756	3936	Client.exe	128
PID 1756 wrote to memory of 3428	1756	CMD.exe	130
PID 3936 wrote to memory of 2708	3936	Client.exe	131
PID 2708 wrote to memory of 5440	2708	CMD.exe	133
PID 3936 wrote to memory of 4076	3936	Client.exe	134
PID 4076 wrote to memory of 6068	4076	CMD.exe	136
PID 3936 wrote to memory of 5868	3936	Client.exe	137
PID 5868 wrote to memory of 5344	5868	CMD.exe	139
PID 3936 wrote to memory of 1792	3936	Client.exe	140
PID 1792 wrote to memory of 5352	1792	CMD.exe	142
PID 3936 wrote to memory of 5244	3936	Client.exe	143
PID 5244 wrote to memory of 2152	5244	CMD.exe	145
PID 3936 wrote to memory of 1748	3936	Client.exe	146
PID 1748 wrote to memory of 1812	1748	CMD.exe	148
PID 3936 wrote to memory of 5932	3936	Client.exe	149
PID 5932 wrote to memory of 5116	5932	CMD.exe	151
PID 3936 wrote to memory of 3428	3936	Client.exe	152
PID 3428 wrote to memory of 2388	3428	CMD.exe	154
PID 3936 wrote to memory of 4972	3936	Client.exe	155
PID 4972 wrote to memory of 3748	4972	CMD.exe	157
PID 3936 wrote to memory of 4088	3936	Client.exe	158
PID 4088 wrote to memory of 924	4088	CMD.exe	160
PID 3936 wrote to memory of 4904	3936	Client.exe	161
PID 4904 wrote to memory of 5344	4904	CMD.exe	163
PID 3936 wrote to memory of 4460	3936	Client.exe	164
PID 4460 wrote to memory of 4152	4460	CMD.exe	166
PID 3936 wrote to memory of 3208	3936	Client.exe	167
PID 3208 wrote to memory of 2212	3208	CMD.exe	169
PID 3936 wrote to memory of 3260	3936	Client.exe	170
PID 3260 wrote to memory of 4384	3260	CMD.exe	172
PID 3936 wrote to memory of 1972	3936	Client.exe	173
PID 1972 wrote to memory of 3824	1972	CMD.exe	175
PID 3936 wrote to memory of 2216	3936	Client.exe	176
PID 2216 wrote to memory of 2084	2216	CMD.exe	178
PID 3936 wrote to memory of 4652	3936	Client.exe	179
PID 4652 wrote to memory of 2800	4652	CMD.exe	181
PID 3936 wrote to memory of 5508	3936	Client.exe	182
PID 5508 wrote to memory of 2752	5508	CMD.exe	184
PID 3936 wrote to memory of 5588	3936	Client.exe	185
PID 5588 wrote to memory of 5780	5588	CMD.exe	187
PID 3936 wrote to memory of 5208	3936	Client.exe	188
PID 5208 wrote to memory of 5768	5208	CMD.exe	190
PID 3936 wrote to memory of 4720	3936	Client.exe	191
PID 4720 wrote to memory of 3776	4720	CMD.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Paint.NET" /tr "C:\Program Files\xdwdWireshark Host.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Paint.NET" /tr "C:\Program Files\xdwdWireshark Host.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Docker Upgrade" /tr "C:\Users\Admin\Music\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Docker Upgrade" /tr "C:\Users\Admin\Music\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:5320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:2844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:6068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:5116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:2388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4384
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:384
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4500
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:4508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:5456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:5128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:2964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:2976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3632
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:4956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:6008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6040

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3936-4-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-11-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-3-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-0-0x00000000004E0000-0x0000000000570000-memory.dmp

Download

memory/3936-5-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-6-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-2-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-9-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-7-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-10-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-8-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/3936-1-0x00007FFE297BF000-0x00007FFE297C0000-memory.dmp

Download

memory/3936-129-0x000000001C1D0000-0x000000001C246000-memory.dmp

Download

memory/3936-130-0x0000000000E50000-0x0000000000E5A000-memory.dmp

Download

memory/3936-149-0x0000000002930000-0x000000000294E000-memory.dmp

Download