sheetrat | ae0729a18ee07ab26988ac63c4393b64724e248377782b6e5626b2c2bafc1ed0

Analysis

user interaction
yes
max time kernel
898s
max time network
901s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 342KB
Sample260421-bbfdcsgx7j
SHA256 ae0729a18ee07ab26988ac63c4393b64724e248377782b6e5626b2c2bafc1ed0
MD5 b90f858706e1cf7d4225a1c443142065
SHA1 9c42117cc517577c22ccb3c7eb377739f55c4c39
SHA512 afec03156055928dedcffc98362a1ac9ae7352aef1e44055babda91246649a5d740dad1faa2efa70fe4a696ce7e0f89cdca62f7eda27106d52c89429caf966d3
SSDEEP 6144:iwWWSewhgHIPk6FJVe6VlWT8b9KzzVIryFWUpSbClvqRS:ipgEJVPVle84z2Sp
TLSH
T1B374C40CFE91F815CE2E3D77CFE614104B7125C26E229242724A6FFE8B5537658A62BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_qisunllwcifjlv execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_qisunllwcifjlv

olegEblanenko-43536.portmap.host:43536

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/2648-0-0x0000000000370000-0x00000000003CA000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\xdwdAudacity.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 7 IoCs

pid	Process
3300	xdwdNode.js.exe
2724	xdwdAudacity.exe
4220	xdwdNode.js.exe
2908	xdwdAudacity.exe
2192	xdwdNode.js.exe
4360	xdwdAudacity.exe
800	xdwdNode.js.exe

Loads dropped DLL 64 IoCs

pid	Process
4216	Process not Found
400	Process not Found
1780	Process not Found
3300	xdwdNode.js.exe
2724	xdwdAudacity.exe
492	Process not Found
3432	Process not Found
1724	Process not Found
4092	Process not Found
4124	Process not Found
2580	Process not Found
1488	Process not Found
1316	Process not Found
3520	Process not Found
4744	Process not Found
1684	Process not Found
4748	Process not Found
5100	Process not Found
3460	Process not Found
4512	Process not Found
840	Process not Found
3992	Process not Found
1548	Process not Found
1620	Process not Found
4028	Process not Found
3620	Process not Found
4324	Process not Found
492	Process not Found
4996	Process not Found
800	Process not Found
3240	Process not Found
124	Process not Found
1392	Process not Found
1052	Process not Found
1708	Process not Found
4204	Process not Found
4212	Process not Found
1788	Process not Found
3708	Process not Found
1700	Process not Found
1252	Process not Found
864	Process not Found
768	Process not Found
2728	Process not Found
2256	Process not Found
3340	Process not Found
4460	Process not Found
2452	Process not Found
1916	Process not Found
4220	Process not Found
3236	Process not Found
3500	Process not Found
4092	Process not Found
1452	Process not Found
672	Process not Found
1488	Process not Found
2400	Process not Found
780	Process not Found
1944	Process not Found
1408	Process not Found
4944	Process not Found
3364	Process not Found
4528	Process not Found
1060	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdNode.js.exe"	Client.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdNode.js.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdNode.js.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
240	schtasks.exe
2256	schtasks.exe
3364	schtasks.exe
3764	schtasks.exe
2888	schtasks.exe
3296	schtasks.exe
1260	schtasks.exe
1512	schtasks.exe
2840	schtasks.exe
1688	schtasks.exe
3608	schtasks.exe
2888	schtasks.exe
4884	schtasks.exe
2356	schtasks.exe
552	schtasks.exe
2260	schtasks.exe
1644	schtasks.exe
2608	schtasks.exe
3900	schtasks.exe
4412	schtasks.exe
3804	schtasks.exe
3312	schtasks.exe
220	schtasks.exe
2600	schtasks.exe
3156	schtasks.exe
2092	schtasks.exe
1296	schtasks.exe
1236	schtasks.exe
2192	schtasks.exe
4624	schtasks.exe
1080	schtasks.exe
3324	schtasks.exe
2508	schtasks.exe
808	schtasks.exe
4928	schtasks.exe
4984	schtasks.exe
2488	schtasks.exe
2980	schtasks.exe
1256	schtasks.exe
3112	schtasks.exe
844	schtasks.exe
4960	schtasks.exe
5044	schtasks.exe
1668	schtasks.exe
2708	schtasks.exe
1012	schtasks.exe
1612	schtasks.exe
4520	schtasks.exe
3372	schtasks.exe
1800	schtasks.exe
4748	schtasks.exe
808	schtasks.exe
2060	schtasks.exe
1688	schtasks.exe
2864	schtasks.exe
3020	schtasks.exe
1224	schtasks.exe
3460	schtasks.exe
4624	schtasks.exe
3432	schtasks.exe
4300	schtasks.exe
2364	schtasks.exe
3720	schtasks.exe
792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
3300	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
4220	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe
2192	xdwdNode.js.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	Client.exe
Token: SeDebugPrivilege	2724	xdwdAudacity.exe
Token: SeDebugPrivilege	3300	xdwdNode.js.exe
Token: SeDebugPrivilege	4220	xdwdNode.js.exe
Token: SeDebugPrivilege	2908	xdwdAudacity.exe
Token: SeDebugPrivilege	2192	xdwdNode.js.exe
Token: SeDebugPrivilege	4360	xdwdAudacity.exe
Token: SeDebugPrivilege	800	xdwdNode.js.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4872	2648	Client.exe	81
PID 4872 wrote to memory of 1712	4872	CMD.exe	83
PID 2648 wrote to memory of 2636	2648	Client.exe	84
PID 2636 wrote to memory of 4624	2636	CMD.exe	86
PID 2648 wrote to memory of 716	2648	Client.exe	87
PID 716 wrote to memory of 3372	716	CMD.exe	89
PID 2648 wrote to memory of 4932	2648	Client.exe	94
PID 4932 wrote to memory of 2524	4932	CMD.exe	96
PID 2648 wrote to memory of 3980	2648	Client.exe	97
PID 3980 wrote to memory of 3748	3980	CMD.exe	99
PID 2648 wrote to memory of 2088	2648	Client.exe	100
PID 2088 wrote to memory of 4180	2088	CMD.exe	102
PID 2648 wrote to memory of 3436	2648	Client.exe	103
PID 3436 wrote to memory of 4852	3436	CMD.exe	105
PID 2724 wrote to memory of 1532	2724	xdwdAudacity.exe	106
PID 1532 wrote to memory of 1392	1532	CMD.exe	108
PID 2648 wrote to memory of 700	2648	Client.exe	109
PID 700 wrote to memory of 2488	700	CMD.exe	111
PID 3300 wrote to memory of 3908	3300	xdwdNode.js.exe	112
PID 3908 wrote to memory of 1668	3908	CMD.exe	114
PID 2724 wrote to memory of 3984	2724	xdwdAudacity.exe	115
PID 3984 wrote to memory of 2236	3984	CMD.exe	117
PID 2648 wrote to memory of 1732	2648	Client.exe	118
PID 1732 wrote to memory of 2512	1732	CMD.exe	120
PID 2648 wrote to memory of 1128	2648	Client.exe	121
PID 1128 wrote to memory of 1364	1128	CMD.exe	123
PID 2648 wrote to memory of 4992	2648	Client.exe	124
PID 4992 wrote to memory of 2356	4992	CMD.exe	126
PID 2648 wrote to memory of 4384	2648	Client.exe	127
PID 4384 wrote to memory of 944	4384	CMD.exe	129
PID 2648 wrote to memory of 3976	2648	Client.exe	130
PID 3976 wrote to memory of 4760	3976	CMD.exe	132
PID 2648 wrote to memory of 2484	2648	Client.exe	133
PID 2484 wrote to memory of 4520	2484	CMD.exe	135
PID 2648 wrote to memory of 5020	2648	Client.exe	136
PID 5020 wrote to memory of 2348	5020	CMD.exe	138
PID 2648 wrote to memory of 5108	2648	Client.exe	139
PID 5108 wrote to memory of 992	5108	CMD.exe	141
PID 2648 wrote to memory of 4076	2648	Client.exe	142
PID 4076 wrote to memory of 1260	4076	CMD.exe	144
PID 2648 wrote to memory of 1600	2648	Client.exe	145
PID 1600 wrote to memory of 2516	1600	CMD.exe	147
PID 2648 wrote to memory of 3140	2648	Client.exe	148
PID 3140 wrote to memory of 2256	3140	CMD.exe	150
PID 2648 wrote to memory of 1104	2648	Client.exe	151
PID 1104 wrote to memory of 2936	1104	CMD.exe	153
PID 2648 wrote to memory of 4192	2648	Client.exe	154
PID 4192 wrote to memory of 2112	4192	CMD.exe	156
PID 2648 wrote to memory of 3868	2648	Client.exe	157
PID 3868 wrote to memory of 1816	3868	CMD.exe	159
PID 2648 wrote to memory of 1340	2648	Client.exe	160
PID 1340 wrote to memory of 4984	1340	CMD.exe	162
PID 2648 wrote to memory of 2456	2648	Client.exe	163
PID 2456 wrote to memory of 2716	2456	CMD.exe	165
PID 2648 wrote to memory of 4032	2648	Client.exe	166
PID 4032 wrote to memory of 3432	4032	CMD.exe	168
PID 2648 wrote to memory of 3848	2648	Client.exe	169
PID 3848 wrote to memory of 688	3848	CMD.exe	171
PID 2648 wrote to memory of 132	2648	Client.exe	172
PID 132 wrote to memory of 552	132	CMD.exe	174
PID 2648 wrote to memory of 1956	2648	Client.exe	175
PID 1956 wrote to memory of 4908	1956	CMD.exe	177
PID 2648 wrote to memory of 2560	2648	Client.exe	178
PID 2560 wrote to memory of 3324	2560	CMD.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Unity" /tr "C:\Users\Admin\xdwdAudacity.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Unity" /tr "C:\Users\Admin\xdwdAudacity.exe"
    3⤵
    PID:1712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "FileZilla" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "FileZilla" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:944
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2264
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4272
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:5016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2264
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3292
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3328
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2708
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:5112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1484
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:5004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:5016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:772
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4308
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:5048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2308
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2632
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:5008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3024
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:8
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:5044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:32
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4944
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:5000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:5028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:5036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1832
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:4728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:2364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:3028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:3448

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1668

C:\Users\Admin\xdwdAudacity.exe
C:\Users\Admin\xdwdAudacity.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:1392
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:2236

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:4668
- C:\Users\Admin\xdwdAudacity.exe
  "C:\Users\Admin\xdwdAudacity.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
    3⤵
    PID:4224
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
      4⤵
      PID:2720
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
    3⤵
    PID:3604
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
      4⤵
      PID:772

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
  2⤵
  PID:1816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
    3⤵
    PID:492
- C:\Users\Admin\xdwdAudacity.exe
  "C:\Users\Admin\xdwdAudacity.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
    3⤵
    PID:992
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
      4⤵
      PID:3304
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST & exit
    3⤵
    PID:4744
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BlueStacks" /tr "C:\Users\Admin\xdwdAudacity.exe" /RL HIGHEST
      4⤵
      PID:2052

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdNode.js.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2648-0-0x0000000000370000-0x00000000003CA000-memory.dmp

Download

memory/2648-1-0x0000000000C00000-0x0000000000C0C000-memory.dmp

Download

memory/2648-33-0x000000001B940000-0x000000001B950000-memory.dmp

Download