sheetrat | a2f14227035eed894f3ffdea1dd4932ef3193152bf45aeee59ae117b89a55880

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JournalTrace.exe
Size 226KB
Sample260806-b3yc9a1cmd
SHA256 a2f14227035eed894f3ffdea1dd4932ef3193152bf45aeee59ae117b89a55880
MD5 76b2e3f45815196d300518b317a7211e
SHA1 a668ad86d7264dd4a8f2c3be2bfef4d12a3fa1bb
SHA512 fc37bae113b8f3870e41c87e88d4259dcf375d1ddb5159c47b9a333c7b57c7e7eb6adedc9da7086889ac5e18c3ee6de0fcc3cab4c81d80102a169dae80164408
SSDEEP 3072:LdLtv/JeQ+aq6VIsgzT+8dpwL4STUEqqvBvvoLyQUDqQt3Ctb6GGObe67i9jyHLz:L/gVptsgJXwEVqvds35QtGbyO1a
TLSH
T15434820CFF90F845CE6E3D37CBE614108B7125C22E219242764A6FFE8B5537658A66BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_hofbhrvmdf execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

2.7.1

Campaign

Sheet_hofbhrvmdf

dre1zid-64501.portmap.host:64501

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/1332-1-0x00000000002F0000-0x000000000032E000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/1332-1-0x00000000002F0000-0x000000000032E000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Documents\\xdwdMicrosoft Security Essentials.exe"	JournalTrace.exe

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4492	CMD.exe
2600	CMD.exe
6128	CMD.exe
5108	CMD.exe
5804	CMD.exe
5380	CMD.exe
1732	CMD.exe
2332	CMD.exe
4128	CMD.exe
4220	CMD.exe
5768	CMD.exe
1180	CMD.exe
1744	CMD.exe
3104	CMD.exe
4808	CMD.exe
2292	CMD.exe
4896	CMD.exe
2036	CMD.exe
4124	CMD.exe
5792	CMD.exe
5184	CMD.exe
6084	CMD.exe
4784	CMD.exe
5292	CMD.exe
4844	CMD.exe
3924	CMD.exe
4216	CMD.exe
1472	CMD.exe
1088	CMD.exe
2696	CMD.exe
1996	CMD.exe
4384	CMD.exe
4856	CMD.exe
6072	CMD.exe
1008	CMD.exe
4888	CMD.exe
4356	CMD.exe
260	CMD.exe
2204	CMD.exe
3372	CMD.exe
2648	CMD.exe
1228	CMD.exe
4832	CMD.exe
3468	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 44 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1960	schtasks.exe
2616	schtasks.exe
4352	schtasks.exe
2552	schtasks.exe
5904	schtasks.exe
3068	schtasks.exe
1376	schtasks.exe
2568	schtasks.exe
612	schtasks.exe
5232	schtasks.exe
3792	schtasks.exe
4236	schtasks.exe
3700	schtasks.exe
752	schtasks.exe
1376	schtasks.exe
1840	schtasks.exe
236	schtasks.exe
5768	schtasks.exe
252	schtasks.exe
4056	schtasks.exe
5292	schtasks.exe
3760	schtasks.exe
4172	schtasks.exe
5972	schtasks.exe
3552	schtasks.exe
5652	schtasks.exe
544	schtasks.exe
4848	schtasks.exe
3436	schtasks.exe
3572	schtasks.exe
4852	schtasks.exe
5292	schtasks.exe
5780	schtasks.exe
4168	schtasks.exe
4716	schtasks.exe
1648	schtasks.exe
2828	schtasks.exe
4728	schtasks.exe
2268	schtasks.exe
3400	schtasks.exe
4208	schtasks.exe
6064	schtasks.exe
6020	schtasks.exe
1548	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	JournalTrace.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3924	1332	JournalTrace.exe	90
PID 3924 wrote to memory of 4352	3924	CMD.exe	92
PID 1332 wrote to memory of 4492	1332	JournalTrace.exe	93
PID 4492 wrote to memory of 4208	4492	CMD.exe	95
PID 1332 wrote to memory of 4128	1332	JournalTrace.exe	96
PID 4128 wrote to memory of 3700	4128	CMD.exe	98
PID 1332 wrote to memory of 2600	1332	JournalTrace.exe	101
PID 2600 wrote to memory of 5768	2600	CMD.exe	103
PID 1332 wrote to memory of 1008	1332	JournalTrace.exe	104
PID 1008 wrote to memory of 2568	1008	CMD.exe	106
PID 1332 wrote to memory of 4832	1332	JournalTrace.exe	107
PID 4832 wrote to memory of 2552	4832	CMD.exe	109
PID 1332 wrote to memory of 2292	1332	JournalTrace.exe	111
PID 2292 wrote to memory of 612	2292	CMD.exe	113
PID 1332 wrote to memory of 3468	1332	JournalTrace.exe	114
PID 3468 wrote to memory of 5652	3468	CMD.exe	116
PID 1332 wrote to memory of 4384	1332	JournalTrace.exe	117
PID 4384 wrote to memory of 4852	4384	CMD.exe	119
PID 1332 wrote to memory of 4888	1332	JournalTrace.exe	120
PID 4888 wrote to memory of 752	4888	CMD.exe	122
PID 1332 wrote to memory of 4896	1332	JournalTrace.exe	123
PID 4896 wrote to memory of 5292	4896	CMD.exe	125
PID 1332 wrote to memory of 4356	1332	JournalTrace.exe	126
PID 4356 wrote to memory of 6064	4356	CMD.exe	128
PID 1332 wrote to memory of 4856	1332	JournalTrace.exe	129
PID 4856 wrote to memory of 5904	4856	CMD.exe	131
PID 1332 wrote to memory of 4220	1332	JournalTrace.exe	132
PID 4220 wrote to memory of 4716	4220	CMD.exe	134
PID 1332 wrote to memory of 4216	1332	JournalTrace.exe	135
PID 4216 wrote to memory of 1648	4216	CMD.exe	137
PID 1332 wrote to memory of 5768	1332	JournalTrace.exe	138
PID 5768 wrote to memory of 2828	5768	CMD.exe	140
PID 1332 wrote to memory of 260	1332	JournalTrace.exe	141
PID 260 wrote to memory of 252	260	CMD.exe	143
PID 1332 wrote to memory of 1180	1332	JournalTrace.exe	144
PID 1180 wrote to memory of 4056	1180	CMD.exe	146
PID 1332 wrote to memory of 1744	1332	JournalTrace.exe	147
PID 1744 wrote to memory of 3068	1744	CMD.exe	149
PID 1332 wrote to memory of 2036	1332	JournalTrace.exe	150
PID 2036 wrote to memory of 1376	2036	CMD.exe	152
PID 1332 wrote to memory of 2204	1332	JournalTrace.exe	153
PID 2204 wrote to memory of 1840	2204	CMD.exe	155
PID 1332 wrote to memory of 4124	1332	JournalTrace.exe	156
PID 4124 wrote to memory of 6020	4124	CMD.exe	158
PID 1332 wrote to memory of 5792	1332	JournalTrace.exe	159
PID 5792 wrote to memory of 5292	5792	CMD.exe	161
PID 1332 wrote to memory of 1472	1332	JournalTrace.exe	162
PID 1472 wrote to memory of 5232	1472	CMD.exe	164
PID 1332 wrote to memory of 1088	1332	JournalTrace.exe	165
PID 1088 wrote to memory of 236	1088	CMD.exe	167
PID 1332 wrote to memory of 6128	1332	JournalTrace.exe	168
PID 6128 wrote to memory of 5780	6128	CMD.exe	170
PID 1332 wrote to memory of 5108	1332	JournalTrace.exe	171
PID 5108 wrote to memory of 1548	5108	CMD.exe	173
PID 1332 wrote to memory of 5184	1332	JournalTrace.exe	174
PID 5184 wrote to memory of 544	5184	CMD.exe	176
PID 1332 wrote to memory of 5804	1332	JournalTrace.exe	177
PID 5804 wrote to memory of 1960	5804	CMD.exe	179
PID 1332 wrote to memory of 6084	1332	JournalTrace.exe	180
PID 6084 wrote to memory of 3760	6084	CMD.exe	182
PID 1332 wrote to memory of 5380	1332	JournalTrace.exe	183
PID 5380 wrote to memory of 4172	5380	CMD.exe	185
PID 1332 wrote to memory of 1732	1332	JournalTrace.exe	186
PID 1732 wrote to memory of 1376	1732	CMD.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JournalTrace.exe
"C:\Users\Admin\AppData\Local\Temp\JournalTrace.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Revit" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Revit" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Malwarebytes" /tr "C:\Users\Admin\Videos\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Malwarebytes" /tr "C:\Users\Admin\Videos\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5292
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5292
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4848
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\Documents\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3400