sheetrat | b9726626774555dd11241ba9a52e1092d9af2f8fd5468d44460a0eed8856980e

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eggdlc.exe
Size 657KB
Sample260807-t3kfhasvb1
SHA256 b9726626774555dd11241ba9a52e1092d9af2f8fd5468d44460a0eed8856980e
MD5 f77ce8dbd3cefb35a27523e88effe19e
SHA1 e6210a2e8311500132634e1bdc663fa5516b44dc
SHA512 7b2026bec575e7ce051a95b434c2bf8659b7e81d9ff1c040e29ca6b0b1ad0da28c3ed2a2bdad91ae26471dffc0588d431a6f844cfb336a4c5558cbdd3827ae57
SSDEEP 12288:L+NLYYHfBG6shAdpM3mkBJSkHukn6lSbnYaxZD:L+NLVBG5ipM3zBr3J
TLSH
T1A0E4B20DBD51F811CE6E3DB38BE290A11B3250C23F129522370A5FFA9B653B659A317D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_wvnkneyyxn execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.4

Campaign

Sheet_wvnkneyyxn

91.92.47.228:7000

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/6084-1-0x0000000000E70000-0x0000000000F1A000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral1/memory/6084-1-0x0000000000E70000-0x0000000000F1A000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\RuntimeBroker.exe"	eggdlc.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
5064	RuntimeBroker.exe
3504	xdwdRuntimeBroker.exe

Loads dropped DLL 64 IoCs

pid	Process
2976	Process not Found
4416	Process not Found
6136	Process not Found
2804	Process not Found
4600	Process not Found
5052	Process not Found
3868	Process not Found
5908	Process not Found
3224	Process not Found
4288	Process not Found
684	WmiApSrv.exe
3504	xdwdRuntimeBroker.exe
4780	Process not Found
464	Process not Found
5996	Process not Found
4280	Process not Found
1784	Process not Found
5608	taskmgr.exe
5444	Process not Found
4588	Process not Found
6088	Process not Found
4448	Process not Found
1180	taskmgr.exe
2832	Process not Found
844	Process not Found
3036	Process not Found
4036	Process not Found
5284	Process not Found
2932	Process not Found
5692	Process not Found
6032	Process not Found
960	Process not Found
3740	Process not Found
3848	Process not Found
2136	Process not Found
4980	Process not Found
2472	Process not Found
2368	Process not Found
5792	Process not Found
204	Process not Found
5696	Process not Found
3540	Process not Found
1080	Process not Found
8	Process not Found
3408	Process not Found
2928	Process not Found
2512	Process not Found
1292	Process not Found
1836	Process not Found
2440	Process not Found
5404	Process not Found
964	Process not Found
5812	Process not Found
4332	Process not Found
4136	Process not Found
2788	Process not Found
4244	Process not Found
5040	Process not Found
6008	Process not Found
5636	Process not Found
4804	Process not Found
4488	Process not Found
1856	Process not Found
5696	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Sub\\xdwdRuntimeBroker.exe"	eggdlc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Sub\RuntimeBroker.exe	eggdlc.exe
File opened for modification	C:\Windows\Sub\RuntimeBroker.exe	eggdlc.exe
File created	C:\Windows\xdwd.dll	eggdlc.exe
File opened for modification	C:\Windows\Sub\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\Sub\RuntimeBroker.exe	xdwdRuntimeBroker.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	CMD.exe
4620	CMD.exe
3564	CMD.exe
2368	CMD.exe
3592	CMD.exe
5700	CMD.exe
1560	CMD.exe
1820	CMD.exe
3212	CMD.exe
2100	CMD.exe
5164	CMD.exe
3092	CMD.exe
1988	CMD.exe
1148	CMD.exe
4624	CMD.exe
3840	CMD.exe
1524	CMD.exe
5308	CMD.exe
4656	CMD.exe
3480	CMD.exe
4288	CMD.exe
4980	CMD.exe
5380	CMD.exe
6100	CMD.exe
6048	CMD.exe
5264	CMD.exe
4344	CMD.exe
4492	CMD.exe
5840	CMD.exe
5276	CMD.exe
1704	CMD.exe
5712	CMD.exe
1516	CMD.exe
1312	CMD.exe
6076	CMD.exe
5996	CMD.exe
5560	CMD.exe
1272	CMD.exe
5912	CMD.exe
5816	CMD.exe
2276	CMD.exe
3252	CMD.exe
248	CMD.exe
5080	CMD.exe
3020	CMD.exe
4340	CMD.exe
4728	CMD.exe
2432	CMD.exe
2188	CMD.exe
6068	CMD.exe
3540	CMD.exe
2056	CMD.exe
588	CMD.exe
2512	CMD.exe
1916	CMD.exe
5532	CMD.exe
3760	CMD.exe
2800	CMD.exe
4048	CMD.exe
4236	CMD.exe
6132	CMD.exe
5976	CMD.exe
3368	CMD.exe
3460	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe
616	schtasks.exe
4940	schtasks.exe
1572	schtasks.exe
964	schtasks.exe
4836	schtasks.exe
4760	schtasks.exe
460	schtasks.exe
1428	schtasks.exe
1548	schtasks.exe
2996	schtasks.exe
5928	schtasks.exe
4616	schtasks.exe
2036	schtasks.exe
2388	schtasks.exe
5660	schtasks.exe
4336	schtasks.exe
3572	schtasks.exe
4408	schtasks.exe
2528	schtasks.exe
5220	schtasks.exe
4052	schtasks.exe
3872	schtasks.exe
4708	schtasks.exe
4836	schtasks.exe
6008	schtasks.exe
1624	schtasks.exe
5556	schtasks.exe
5188	schtasks.exe
452	schtasks.exe
1048	schtasks.exe
5320	schtasks.exe
6088	schtasks.exe
2244	schtasks.exe
1400	schtasks.exe
4320	schtasks.exe
1692	schtasks.exe
4592	schtasks.exe
1096	schtasks.exe
1400	schtasks.exe
3572	schtasks.exe
5496	schtasks.exe
2912	schtasks.exe
4560	schtasks.exe
2320	schtasks.exe
928	schtasks.exe
4924	schtasks.exe
1872	schtasks.exe
2576	schtasks.exe
2768	schtasks.exe
3408	schtasks.exe
2708	schtasks.exe
4828	schtasks.exe
2056	schtasks.exe
3232	schtasks.exe
4072	schtasks.exe
2524	schtasks.exe
2164	schtasks.exe
4812	schtasks.exe
6116	schtasks.exe
4592	schtasks.exe
5772	schtasks.exe
4100	schtasks.exe
4144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
684	WmiApSrv.exe
684	WmiApSrv.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
6084	eggdlc.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
6084	eggdlc.exe
6084	eggdlc.exe
5608	taskmgr.exe
5608	taskmgr.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe
5064	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6084	eggdlc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6084	eggdlc.exe
Token: SeDebugPrivilege	5064	RuntimeBroker.exe
Token: SeDebugPrivilege	3504	xdwdRuntimeBroker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1180	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 4152	6084	eggdlc.exe	90
PID 4152 wrote to memory of 4692	4152	CMD.exe	92
PID 6084 wrote to memory of 3368	6084	eggdlc.exe	93
PID 3368 wrote to memory of 5556	3368	CMD.exe	95
PID 6084 wrote to memory of 1916	6084	eggdlc.exe	96
PID 1916 wrote to memory of 4828	1916	CMD.exe	98
PID 6084 wrote to memory of 700	6084	eggdlc.exe	101
PID 700 wrote to memory of 5928	700	CMD.exe	103
PID 6084 wrote to memory of 4624	6084	eggdlc.exe	104
PID 4624 wrote to memory of 4616	4624	CMD.exe	106
PID 6084 wrote to memory of 1712	6084	eggdlc.exe	109
PID 1712 wrote to memory of 5188	1712	CMD.exe	111
PID 6084 wrote to memory of 5532	6084	eggdlc.exe	112
PID 5532 wrote to memory of 4304	5532	CMD.exe	114
PID 6084 wrote to memory of 3760	6084	eggdlc.exe	115
PID 3760 wrote to memory of 4812	3760	CMD.exe	117
PID 5064 wrote to memory of 2100	5064	RuntimeBroker.exe	122
PID 5064 wrote to memory of 5816	5064	RuntimeBroker.exe	124
PID 3504 wrote to memory of 5164	3504	xdwdRuntimeBroker.exe	126
PID 2100 wrote to memory of 2320	2100	CMD.exe	128
PID 5164 wrote to memory of 1096	5164	CMD.exe	129
PID 5816 wrote to memory of 1436	5816	CMD.exe	130
PID 6084 wrote to memory of 5308	6084	eggdlc.exe	131
PID 5308 wrote to memory of 452	5308	CMD.exe	133
PID 5064 wrote to memory of 3460	5064	RuntimeBroker.exe	135
PID 3460 wrote to memory of 928	3460	CMD.exe	137
PID 6084 wrote to memory of 5712	6084	eggdlc.exe	138
PID 5712 wrote to memory of 4376	5712	CMD.exe	140
PID 5064 wrote to memory of 1516	5064	RuntimeBroker.exe	141
PID 1516 wrote to memory of 4924	1516	CMD.exe	143
PID 6084 wrote to memory of 4656	6084	eggdlc.exe	145
PID 4656 wrote to memory of 1872	4656	CMD.exe	147
PID 5064 wrote to memory of 1312	5064	RuntimeBroker.exe	149
PID 1312 wrote to memory of 2036	1312	CMD.exe	151
PID 6084 wrote to memory of 2432	6084	eggdlc.exe	152
PID 2432 wrote to memory of 2576	2432	CMD.exe	154
PID 5064 wrote to memory of 2276	5064	RuntimeBroker.exe	155
PID 2276 wrote to memory of 2056	2276	CMD.exe	157
PID 6084 wrote to memory of 1588	6084	eggdlc.exe	158
PID 1588 wrote to memory of 1560	1588	CMD.exe	160
PID 5064 wrote to memory of 1288	5064	RuntimeBroker.exe	161
PID 1288 wrote to memory of 1400	1288	CMD.exe	163
PID 6084 wrote to memory of 988	6084	eggdlc.exe	164
PID 988 wrote to memory of 1572	988	CMD.exe	166
PID 5064 wrote to memory of 3592	5064	RuntimeBroker.exe	167
PID 3592 wrote to memory of 964	3592	CMD.exe	169
PID 6084 wrote to memory of 5700	6084	eggdlc.exe	170
PID 5700 wrote to memory of 2388	5700	CMD.exe	172
PID 5064 wrote to memory of 3092	5064	RuntimeBroker.exe	173
PID 3092 wrote to memory of 4836	3092	CMD.exe	175
PID 6084 wrote to memory of 6076	6084	eggdlc.exe	176
PID 6076 wrote to memory of 3232	6076	CMD.exe	178
PID 5064 wrote to memory of 1148	5064	RuntimeBroker.exe	179
PID 1148 wrote to memory of 4100	1148	CMD.exe	181
PID 6084 wrote to memory of 1096	6084	eggdlc.exe	182
PID 1096 wrote to memory of 2528	1096	CMD.exe	184
PID 5064 wrote to memory of 3252	5064	RuntimeBroker.exe	185
PID 3252 wrote to memory of 4072	3252	CMD.exe	187
PID 6084 wrote to memory of 5996	6084	eggdlc.exe	188
PID 5996 wrote to memory of 3796	5996	CMD.exe	190
PID 5064 wrote to memory of 2188	5064	RuntimeBroker.exe	191
PID 2188 wrote to memory of 5220	2188	CMD.exe	193
PID 6084 wrote to memory of 5680	6084	eggdlc.exe	194
PID 5680 wrote to memory of 4052	5680	CMD.exe	196

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eggdlc.exe
"C:\Users\Admin\AppData\Local\Temp\eggdlc.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe"
    3⤵
    PID:4692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:1560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:3796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:1976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:1428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:4276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1272
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:6032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:2868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2164
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:5520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:2036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:4648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:3612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:5396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:1116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:3356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:3516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:3392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:4580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:3100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1400

C:\Windows\Sub\RuntimeBroker.exe
C:\Windows\Sub\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:1436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:2948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:4884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:1928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:3036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:1056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:2844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:2740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:4828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5496
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:2928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:1836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:5892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:6032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:2080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:2472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:3280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:2532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:2804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    PID:4856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  PID:3512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2996

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:684

C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Eggdlc.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1096

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5608

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-208-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/684-232-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/684-226-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/1180-229-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/1180-228-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/3504-222-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/3504-212-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/5608-219-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/5608-220-0x00007FFB782C0000-0x00007FFB782E2000-memory.dmp

Download

memory/6084-149-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/6084-119-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/6084-1-0x0000000000E70000-0x0000000000F1A000-memory.dmp

Download

memory/6084-46-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/6084-3-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/6084-2-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/6084-0-0x00007FFB6CF5F000-0x00007FFB6CF60000-memory.dmp

Download