sheetrat | 41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227

Analysis

max time kernel
137s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
Size 576KB
Sample260830-zk8chadb78
SHA256 41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227
MD5 ea469d821b328f07217fe36308cda35c
SHA1 d7d88cb9383236d3ed6f4775ffa3ae479c83e8e2
SHA512 72180e9cc72176371fc414df8a3671aa7d34ba9716a04702dfab6e1169881687e59814096aa0a1550933d806c3e1b8f86a50435ece4e6c7d64828de3d78223df
SSDEEP 12288:ikDTXjPVcnePt4ObpZx4Ik8LUVbXJuUq61TtovCw:N55l4ypxkJVVuUxhto
TLSH
T173C4B2257FB4AD00F548143E897B2618DB31E0E21A03B3477706B6A25D0A9DDEF6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

0.5.0

bore.pub:54321

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4788-1-0x0000000000E80000-0x0000000000F16000-memory.dmp	family_sheetrat_v4
behavioral2/files/0x000d00000001c619-12.dat	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\xdwdKMS_Updater64.exe"	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 62 IoCs

pid	Process
3740	xdwdKMS_Updater64.exe
5960	xdwdKMS_Updater64.exe
3784	xdwdKMS_Updater64.exe
4828	xdwdKMS_Updater64.exe
3532	xdwdKMS_Updater64.exe
1212	xdwdKMS_Updater64.exe
5752	xdwdKMS_Updater64.exe
4956	xdwdKMS_Updater64.exe
296	xdwdKMS_Updater64.exe
264	xdwdKMS_Updater64.exe
6200	xdwdKMS_Updater64.exe
4092	xdwdKMS_Updater64.exe
6040	xdwdKMS_Updater64.exe
248	xdwdKMS_Updater64.exe
2540	xdwdKMS_Updater64.exe
4396	xdwdKMS_Updater64.exe
4384	xdwdKMS_Updater64.exe
1104	xdwdKMS_Updater64.exe
4144	xdwdKMS_Updater64.exe
3180	xdwdKMS_Updater64.exe
5216	xdwdKMS_Updater64.exe
2688	xdwdKMS_Updater64.exe
1244	xdwdKMS_Updater64.exe
1380	xdwdKMS_Updater64.exe
6784	xdwdKMS_Updater64.exe
760	xdwdKMS_Updater64.exe
4816	xdwdKMS_Updater64.exe
7032	xdwdKMS_Updater64.exe
3248	xdwdKMS_Updater64.exe
256	xdwdKMS_Updater64.exe
6860	xdwdKMS_Updater64.exe
7072	xdwdKMS_Updater64.exe
3420	xdwdKMS_Updater64.exe
1756	xdwdKMS_Updater64.exe
5360	xdwdKMS_Updater64.exe
2656	xdwdKMS_Updater64.exe
3436	xdwdKMS_Updater64.exe
4940	xdwdKMS_Updater64.exe
1764	xdwdKMS_Updater64.exe
4104	xdwdKMS_Updater64.exe
3932	xdwdKMS_Updater64.exe
6884	xdwdKMS_Updater64.exe
6544	xdwdKMS_Updater64.exe
2832	xdwdKMS_Updater64.exe
5340	xdwdKMS_Updater64.exe
7040	xdwdKMS_Updater64.exe
4184	xdwdKMS_Updater64.exe
1124	xdwdKMS_Updater64.exe
4136	xdwdKMS_Updater64.exe
4920	xdwdKMS_Updater64.exe
6164	xdwdKMS_Updater64.exe
1308	xdwdKMS_Updater64.exe
5548	xdwdKMS_Updater64.exe
2576	xdwdKMS_Updater64.exe
5932	xdwdKMS_Updater64.exe
5524	xdwdKMS_Updater64.exe
5276	xdwdKMS_Updater64.exe
6496	xdwdKMS_Updater64.exe
864	xdwdKMS_Updater64.exe
1892	xdwdKMS_Updater64.exe
1612	xdwdKMS_Updater64.exe
1896	xdwdKMS_Updater64.exe

Loads dropped DLL 64 IoCs

pid	Process
3740	xdwdKMS_Updater64.exe
3064	Process not Found
3348	Process not Found
5960	xdwdKMS_Updater64.exe
3784	xdwdKMS_Updater64.exe
3708	Process not Found
2944	Process not Found
2236	Process not Found
6096	Process not Found
4412	Process not Found
5928	Process not Found
1800	Process not Found
2916	Process not Found
4952	Process not Found
1484	Process not Found
6860	Process not Found
6740	Process not Found
6380	Process not Found
5924	Process not Found
6216	Process not Found
2816	Process not Found
1872	Process not Found
3888	Process not Found
5012	Process not Found
1860	Process not Found
6492	Process not Found
1132	Process not Found
4900	Process not Found
6808	Process not Found
1856	Process not Found
5068	Process not Found
5372	Process not Found
2920	Process not Found
4828	xdwdKMS_Updater64.exe
3532	xdwdKMS_Updater64.exe
1212	xdwdKMS_Updater64.exe
5752	xdwdKMS_Updater64.exe
296	xdwdKMS_Updater64.exe
4956	xdwdKMS_Updater64.exe
264	xdwdKMS_Updater64.exe
6200	xdwdKMS_Updater64.exe
4092	xdwdKMS_Updater64.exe
248	xdwdKMS_Updater64.exe
6040	xdwdKMS_Updater64.exe
2540	xdwdKMS_Updater64.exe
4396	xdwdKMS_Updater64.exe
4384	xdwdKMS_Updater64.exe
1104	xdwdKMS_Updater64.exe
4144	xdwdKMS_Updater64.exe
4308	Process not Found
1064	Process not Found
2604	Process not Found
2536	Process not Found
696	Process not Found
6872	Process not Found
2632	Process not Found
2520	Process not Found
3292	Process not Found
3468	Process not Found
5708	Process not Found
3836	Process not Found
3436	Process not Found
1516	Process not Found
1672	Process not Found

Drops file in Windows directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File created	C:\Windows\Sub\xdwdWindowsUpdate.exe	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
File created	C:\Windows\xdwd.dll	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
File opened for modification	C:\Windows\xdwd.dll	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File created	C:\Windows\Sub\xdwdKMS_Updater64.exe	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdKMS_Updater64.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdKMS_Updater64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7384	cmd.exe
4380	cmd.exe
7332	cmd.exe
7424	cmd.exe
6120	cmd.exe
5400	cmd.exe
2460	cmd.exe
7456	cmd.exe
7696	cmd.exe
2140	cmd.exe
5448	cmd.exe
6308	cmd.exe
1088	cmd.exe
1436	cmd.exe
236	cmd.exe
2488	cmd.exe
2564	cmd.exe
6064	cmd.exe
6740	cmd.exe
3920	cmd.exe
360	cmd.exe
2268	cmd.exe
620	cmd.exe
5364	cmd.exe
4552	cmd.exe
1916	cmd.exe
4976	cmd.exe
5684	cmd.exe
5636	cmd.exe
4324	cmd.exe
7340	cmd.exe
564	cmd.exe
1296	cmd.exe
6600	cmd.exe
1096	cmd.exe
1236	cmd.exe
7184	cmd.exe
1388	cmd.exe
3380	cmd.exe
4680	cmd.exe
5092	cmd.exe
1548	cmd.exe
4592	cmd.exe
7516	cmd.exe
4488	cmd.exe
2000	cmd.exe
6432	cmd.exe
4280	cmd.exe
6192	cmd.exe
4516	cmd.exe
3012	cmd.exe
1552	cmd.exe
4544	cmd.exe
2604	cmd.exe
6736	cmd.exe
3044	cmd.exe
7592	cmd.exe
2492	cmd.exe
3400	cmd.exe
2592	cmd.exe
6264	cmd.exe
4368	cmd.exe
4780	cmd.exe
6564	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3040	schtasks.exe
4840	schtasks.exe
5424	schtasks.exe
5000	schtasks.exe
5356	schtasks.exe
7040	schtasks.exe
1704	schtasks.exe
2144	schtasks.exe
6876	schtasks.exe
2240	schtasks.exe
6536	schtasks.exe
2120	schtasks.exe
6244	schtasks.exe
5188	schtasks.exe
4488	schtasks.exe
4128	schtasks.exe
5672	schtasks.exe
6948	schtasks.exe
504	schtasks.exe
2636	schtasks.exe
2744	schtasks.exe
1452	schtasks.exe
3120	schtasks.exe
4332	schtasks.exe
1440	schtasks.exe
4212	schtasks.exe
3624	schtasks.exe
4580	schtasks.exe
3296	schtasks.exe
4192	schtasks.exe
2892	schtasks.exe
3304	schtasks.exe
5040	schtasks.exe
6000	schtasks.exe
5064	schtasks.exe
7200	schtasks.exe
2432	schtasks.exe
2860	schtasks.exe
6228	schtasks.exe
5704	schtasks.exe
1308	schtasks.exe
368	schtasks.exe
7352	schtasks.exe
7132	schtasks.exe
6888	schtasks.exe
1384	schtasks.exe
1640	schtasks.exe
6984	schtasks.exe
1044	schtasks.exe
3816	schtasks.exe
5880	schtasks.exe
6224	schtasks.exe
3560	schtasks.exe
6024	schtasks.exe
4920	schtasks.exe
1984	schtasks.exe
6744	schtasks.exe
4376	schtasks.exe
7492	schtasks.exe
6732	schtasks.exe
6828	schtasks.exe
3852	schtasks.exe
6184	schtasks.exe
7472	schtasks.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
Token: SeDebugPrivilege	3740	xdwdKMS_Updater64.exe
Token: SeIncBasePriorityPrivilege	3740	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	5960	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	3784	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	3532	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	4828	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	1212	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	5752	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	4956	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	296	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	6200	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	4092	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	6040	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	264	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	2540	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	248	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	4144	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	4384	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	1104	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	4396	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	3180	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	760	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	2688	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	5216	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	1380	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	256	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	1244	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	7032	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	4816	xdwdKMS_Updater64.exe
Token: SeDebugPrivilege	3248	xdwdKMS_Updater64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1128	4788	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe	92
PID 4788 wrote to memory of 3400	4788	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe	93
PID 3400 wrote to memory of 4840	3400	cmd.exe	96
PID 4788 wrote to memory of 4544	4788	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe	97
PID 4544 wrote to memory of 1440	4544	cmd.exe	99
PID 4788 wrote to memory of 3740	4788	41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe	100
PID 3740 wrote to memory of 3352	3740	xdwdKMS_Updater64.exe	101
PID 3352 wrote to memory of 6244	3352	cmd.exe	103
PID 3740 wrote to memory of 5080	3740	xdwdKMS_Updater64.exe	104
PID 5080 wrote to memory of 3852	5080	cmd.exe	106
PID 3740 wrote to memory of 2140	3740	xdwdKMS_Updater64.exe	109
PID 3740 wrote to memory of 1176	3740	xdwdKMS_Updater64.exe	111
PID 2140 wrote to memory of 6232	2140	cmd.exe	113
PID 1176 wrote to memory of 5188	1176	cmd.exe	114
PID 5960 wrote to memory of 5104	5960	xdwdKMS_Updater64.exe	115
PID 5104 wrote to memory of 4488	5104	cmd.exe	117
PID 5960 wrote to memory of 6700	5960	xdwdKMS_Updater64.exe	118
PID 6700 wrote to memory of 6224	6700	cmd.exe	120
PID 3784 wrote to memory of 564	3784	xdwdKMS_Updater64.exe	121
PID 564 wrote to memory of 2360	564	cmd.exe	123
PID 3784 wrote to memory of 3800	3784	xdwdKMS_Updater64.exe	124
PID 3800 wrote to memory of 3296	3800	cmd.exe	126
PID 3740 wrote to memory of 5448	3740	xdwdKMS_Updater64.exe	127
PID 3740 wrote to memory of 4280	3740	xdwdKMS_Updater64.exe	129
PID 5448 wrote to memory of 6732	5448	cmd.exe	130
PID 4280 wrote to memory of 6828	4280	cmd.exe	132
PID 3740 wrote to memory of 1296	3740	xdwdKMS_Updater64.exe	133
PID 1296 wrote to memory of 1704	1296	cmd.exe	135
PID 3740 wrote to memory of 5772	3740	xdwdKMS_Updater64.exe	136
PID 5772 wrote to memory of 2144	5772	cmd.exe	138
PID 3740 wrote to memory of 6820	3740	xdwdKMS_Updater64.exe	140
PID 6820 wrote to memory of 6876	6820	cmd.exe	142
PID 3740 wrote to memory of 1156	3740	xdwdKMS_Updater64.exe	143
PID 1156 wrote to memory of 3552	1156	cmd.exe	145
PID 3740 wrote to memory of 2488	3740	xdwdKMS_Updater64.exe	146
PID 2488 wrote to memory of 2432	2488	cmd.exe	148
PID 3740 wrote to memory of 1620	3740	xdwdKMS_Updater64.exe	149
PID 1620 wrote to memory of 4912	1620	cmd.exe	151
PID 3740 wrote to memory of 4552	3740	xdwdKMS_Updater64.exe	152
PID 4552 wrote to memory of 3904	4552	cmd.exe	154
PID 3740 wrote to memory of 7008	3740	xdwdKMS_Updater64.exe	155
PID 7008 wrote to memory of 2152	7008	cmd.exe	157
PID 3740 wrote to memory of 4672	3740	xdwdKMS_Updater64.exe	158
PID 4672 wrote to memory of 1076	4672	cmd.exe	160
PID 3740 wrote to memory of 2564	3740	xdwdKMS_Updater64.exe	161
PID 2564 wrote to memory of 2240	2564	cmd.exe	163
PID 3740 wrote to memory of 6064	3740	xdwdKMS_Updater64.exe	164
PID 6064 wrote to memory of 3560	6064	cmd.exe	166
PID 3740 wrote to memory of 2684	3740	xdwdKMS_Updater64.exe	167
PID 2684 wrote to memory of 2860	2684	cmd.exe	169
PID 3740 wrote to memory of 2592	3740	xdwdKMS_Updater64.exe	170
PID 2592 wrote to memory of 6536	2592	cmd.exe	172
PID 3740 wrote to memory of 6308	3740	xdwdKMS_Updater64.exe	173
PID 6308 wrote to memory of 6024	6308	cmd.exe	175
PID 3740 wrote to memory of 1604	3740	xdwdKMS_Updater64.exe	176
PID 1604 wrote to memory of 4192	1604	cmd.exe	178
PID 3740 wrote to memory of 3048	3740	xdwdKMS_Updater64.exe	179
PID 3048 wrote to memory of 3040	3048	cmd.exe	181
PID 3740 wrote to memory of 2284	3740	xdwdKMS_Updater64.exe	182
PID 2284 wrote to memory of 4128	2284	cmd.exe	184
PID 3740 wrote to memory of 6120	3740	xdwdKMS_Updater64.exe	185
PID 6120 wrote to memory of 2744	6120	cmd.exe	187
PID 3740 wrote to memory of 5364	3740	xdwdKMS_Updater64.exe	188
PID 5364 wrote to memory of 6508	5364	cmd.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe
"C:\Users\Admin\AppData\Local\Temp\41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="G _9{U^K{_Ez{<" dir=in action=allow program="C:\Windows\Sub\xdwdKMS_Updater64.exe" enable=yes & exit
  2⤵
  PID:1128
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1440
- C:\Windows\Sub\xdwdKMS_Updater64.exe
  "C:\Windows\Sub\xdwdKMS_Updater64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:6232
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5188
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6828
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6876
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:3552
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:4912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:3904
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7008
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:2152
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:1076
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2860
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6308
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6024
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3040
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4128
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:6508
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2864
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    PID:200
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:6520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:3964
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    PID:5712
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:4476
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4368
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:6896
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4488
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:6272
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    PID:7136
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:504
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:1752
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2604
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:4100
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:4772
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:6736
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2636
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6960
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:1732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    PID:6992
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:6796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:1452
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4212
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4592
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:3424
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:3564
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2892
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:6740
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3304
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:7016
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4780
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:4236
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5040
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:6564
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:6392
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:4492
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:6188
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    PID:6460
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:5436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5684
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:4436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1096
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6000
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:1640
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:7092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    PID:5268
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      PID:5432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6904
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:236
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:368
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:4700
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4376

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6700
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6224

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3296

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4828
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:1652
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5540
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4680
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1384
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1388
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3444

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:2260
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5916
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3120

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5752
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4516
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2120
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5092
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6740

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4956
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6600
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1916
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6492

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:296
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6192
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:5884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1372
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1452

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:264
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:6844
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2828
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6648

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4976
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1252
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4332

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1552
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7004
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6148

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3012
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6984
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1308

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:3664
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6680
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:368

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:5044
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1548
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6884

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4384
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6432
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6948
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5168
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1440

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4396
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1088
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6260
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4376

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1104
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6264
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:5160
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5984
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4144
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2000
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:2456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5672

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3180
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:4496
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5720

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:6956
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2932

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:4156
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:360

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5400
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7404

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:6244
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:7272
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1792

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:6784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7184
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7456

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:5072
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1436
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7200

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:1224
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2492
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7472

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7032
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:3232
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4252

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3044
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7352
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4736

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:256
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1236
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:7396
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5884

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:6860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7236

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:7072

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:3420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7312

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:5360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7696

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:2656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2460
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3224

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:4940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4324

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:1764
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:6316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2268
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7620

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:4104

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:3932
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7436

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:6884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7516

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:6544
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3380

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:2832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7324

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:5340
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:2556
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1312
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7500

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:7040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:4452
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    PID:7708
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5636

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:1124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7444

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:6756
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7492
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2164

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:4920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7296

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:6164
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7288

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:1308
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7332

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:2576
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7592

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:5932
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7424

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:5524
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  PID:7264

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:5276

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:6496

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7340

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdKMS_Updater64.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7384

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\Sub\xdwdKMS_Updater64.exe
"C:\Windows\Sub\xdwdKMS_Updater64.exe"
1⤵
- Executes dropped EXE
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdKMS_Updater64.exe

Path C:\Windows\Sub\xdwdKMS_Updater64.exe
Size 576KB
SHA256 41c081678ddcf41b409fcbaeba8d803742ae1a4931b2df0f5a5a8699d7636227
MD5 ea469d821b328f07217fe36308cda35c
SHA1 d7d88cb9383236d3ed6f4775ffa3ae479c83e8e2
SHA512 72180e9cc72176371fc414df8a3671aa7d34ba9716a04702dfab6e1169881687e59814096aa0a1550933d806c3e1b8f86a50435ece4e6c7d64828de3d78223df
SSDEEP 12288:ikDTXjPVcnePt4ObpZx4Ik8LUVbXJuUq61TtovCw:N55l4ypxkJVVuUxhto
TLSH
T173C4B2257FB4AD00F548143E897B2618DB31E0E21A03B3477706B6A25D0A9DDEF6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4788-1-0x0000000000E80000-0x0000000000F16000-memory.dmp

Download

memory/4788-0-0x00007FFE3558F000-0x00007FFE35590000-memory.dmp

Download

memory/4788-2-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4788-3-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4788-4-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4788-5-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4788-6-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4788-7-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4788-106-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads