sheetrat | 3b577b3d2df27c031e60f60aa1c92032cc9316207fb036c02886f2e1cf21e14a

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/11/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 478KB
Sample261112-p14ddafe69
SHA256 3b577b3d2df27c031e60f60aa1c92032cc9316207fb036c02886f2e1cf21e14a
MD5 51ea4486faf3ff7b5689c608dbc529b4
SHA1 8125b4c756f8ea53c5bd778ec78625ef5d2a48bb
SHA512 86581d25dba0bdcc77dc2df7343f7e2ef35aff3caaf7d2d689424b4cea6a0565989aed3f0929c34c81c2c0f4e19f10bc2e7dd9b3671099c1fd4e3dd524b1d544
SSDEEP 6144:QZSuouUTtqWWtXQIc9PAhGGxe6VlWT8b9I8V1nsqTjDNF4bU6bEv21qk2oV:nuou09WtLY2GqPVle8C8vTjhl1k24
TLSH
T197A4A10CFE91F809DD1E3D73CBE514144BB165C16E219282266AAFFD8B563B348E267C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_sljemcznmw discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_sljemcznmw

pidor1337228-56623.portmap.host:56623

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/3100-0-0x0000000000B70000-0x0000000000BEE000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral1/memory/3100-0-0x0000000000B70000-0x0000000000BEE000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdUnreal Engine.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	xdwdGIMP Upgrade.exe

Executes dropped EXE 2 IoCs

pid	Process
4724	xdwdGIMP Upgrade.exe
2404	xdwdUnreal Engine.exe

Loads dropped DLL 51 IoCs

pid	Process
4480	Process not Found
2812	Process not Found
3964	Process not Found
3172	Process not Found
4712	Process not Found
4724	xdwdGIMP Upgrade.exe
5072	Process not Found
452	Process not Found
2320	Process not Found
4068	Process not Found
2800	Process not Found
2880	Process not Found
2404	xdwdUnreal Engine.exe
664	Process not Found
2144	Process not Found
2352	Process not Found
3916	Process not Found
4804	Process not Found
2244	Process not Found
4916	Process not Found
3352	Process not Found
1696	Process not Found
1876	Process not Found
5072	Process not Found
3912	Process not Found
4864	Process not Found
2248	Process not Found
2136	Process not Found
4876	Process not Found
5104	Process not Found
2800	Process not Found
4212	Process not Found
5116	Process not Found
2060	Process not Found
2112	Process not Found
3448	Process not Found
2968	Process not Found
4516	Process not Found
3820	Process not Found
2244	Process not Found
1720	Process not Found
3864	Process not Found
1736	Process not Found
4860	Process not Found
2664	Process not Found
3504	Process not Found
4496	Process not Found
2372	Process not Found
2656	Process not Found
3388	Process not Found
2136	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\atom = "C:\\Windows\\xdwdGIMP Upgrade.exe"	Client.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\xdwdGIMP Upgrade.exe	Client.exe
File opened for modification	C:\Windows\xdwdGIMP Upgrade.exe	Client.exe
File created	C:\Windows\xdwd.dll	Client.exe
File opened for modification	C:\Windows\xdwdGIMP Upgrade.exe	xdwdGIMP Upgrade.exe
File opened for modification	C:\Windows\xdwdGIMP Upgrade.exe	xdwdUnreal Engine.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 47 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3728	CMD.exe
4612	CMD.exe
852	CMD.exe
3092	CMD.exe
1544	CMD.exe
1160	CMD.exe
3796	CMD.exe
212	CMD.exe
3852	CMD.exe
4916	CMD.exe
3352	CMD.exe
4960	CMD.exe
2320	CMD.exe
2680	CMD.exe
3984	CMD.exe
4616	CMD.exe
4224	CMD.exe
4596	CMD.exe
3068	CMD.exe
4884	CMD.exe
2072	CMD.exe
4012	CMD.exe
2020	CMD.exe
1092	CMD.exe
4764	CMD.exe
452	CMD.exe
4680	CMD.exe
4152	CMD.exe
2160	CMD.exe
4552	CMD.exe
4080	CMD.exe
3844	CMD.exe
544	CMD.exe
3608	CMD.exe
2676	CMD.exe
1100	CMD.exe
4856	CMD.exe
4100	CMD.exe
1504	CMD.exe
4344	CMD.exe
2056	CMD.exe
2456	CMD.exe
2532	CMD.exe
4456	CMD.exe
4564	CMD.exe
2848	CMD.exe
3132	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdGIMP Upgrade.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdGIMP Upgrade.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdUnreal Engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdUnreal Engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4748	schtasks.exe
3316	schtasks.exe
1008	schtasks.exe
4208	schtasks.exe
3168	schtasks.exe
4660	schtasks.exe
3832	schtasks.exe
2592	schtasks.exe
2412	schtasks.exe
204	schtasks.exe
3840	schtasks.exe
4268	schtasks.exe
2732	schtasks.exe
980	schtasks.exe
2068	schtasks.exe
4500	schtasks.exe
4456	schtasks.exe
4044	schtasks.exe
3524	schtasks.exe
2812	schtasks.exe
2988	schtasks.exe
560	schtasks.exe
4680	schtasks.exe
1604	schtasks.exe
3380	schtasks.exe
3892	schtasks.exe
636	schtasks.exe
2900	schtasks.exe
4744	schtasks.exe
3748	schtasks.exe
796	schtasks.exe
1628	schtasks.exe
404	schtasks.exe
372	schtasks.exe
740	schtasks.exe
1244	schtasks.exe
5096	schtasks.exe
948	schtasks.exe
2924	schtasks.exe
1992	schtasks.exe
3788	schtasks.exe
1760	schtasks.exe
688	schtasks.exe
4880	schtasks.exe
5080	schtasks.exe
1036	schtasks.exe
4792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe
3100	Client.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	Client.exe
Token: SeDebugPrivilege	4724	xdwdGIMP Upgrade.exe
Token: SeDebugPrivilege	2404	xdwdUnreal Engine.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3728	3100	Client.exe	91
PID 3728 wrote to memory of 3832	3728	CMD.exe	93
PID 3100 wrote to memory of 1504	3100	Client.exe	94
PID 1504 wrote to memory of 4680	1504	CMD.exe	96
PID 3100 wrote to memory of 4884	3100	Client.exe	97
PID 4884 wrote to memory of 3316	4884	CMD.exe	99
PID 3100 wrote to memory of 4612	3100	Client.exe	100
PID 4612 wrote to memory of 4744	4612	CMD.exe	102
PID 3100 wrote to memory of 2072	3100	Client.exe	107
PID 2072 wrote to memory of 1604	2072	CMD.exe	109
PID 3100 wrote to memory of 4344	3100	Client.exe	110
PID 4344 wrote to memory of 1760	4344	CMD.exe	112
PID 3100 wrote to memory of 2680	3100	Client.exe	113
PID 2680 wrote to memory of 688	2680	CMD.exe	115
PID 3100 wrote to memory of 3984	3100	Client.exe	116
PID 3984 wrote to memory of 3748	3984	CMD.exe	118
PID 4724 wrote to memory of 3844	4724	xdwdGIMP Upgrade.exe	120
PID 3844 wrote to memory of 1008	3844	CMD.exe	122
PID 3100 wrote to memory of 544	3100	Client.exe	123
PID 544 wrote to memory of 4208	544	CMD.exe	125
PID 4724 wrote to memory of 2404	4724	xdwdGIMP Upgrade.exe	126
PID 3100 wrote to memory of 4012	3100	Client.exe	128
PID 4012 wrote to memory of 2592	4012	CMD.exe	130
PID 3100 wrote to memory of 3852	3100	Client.exe	131
PID 3852 wrote to memory of 4456	3852	CMD.exe	133
PID 3100 wrote to memory of 4680	3100	Client.exe	134
PID 4680 wrote to memory of 2412	4680	CMD.exe	136
PID 3100 wrote to memory of 3608	3100	Client.exe	137
PID 3608 wrote to memory of 3168	3608	CMD.exe	139
PID 2404 wrote to memory of 852	2404	xdwdUnreal Engine.exe	140
PID 852 wrote to memory of 204	852	CMD.exe	142
PID 2404 wrote to memory of 3092	2404	xdwdUnreal Engine.exe	143
PID 3092 wrote to memory of 796	3092	CMD.exe	145
PID 3100 wrote to memory of 2056	3100	Client.exe	146
PID 2056 wrote to memory of 3840	2056	CMD.exe	148
PID 2404 wrote to memory of 2020	2404	xdwdUnreal Engine.exe	149
PID 2020 wrote to memory of 4268	2020	CMD.exe	151
PID 3100 wrote to memory of 1544	3100	Client.exe	152
PID 1544 wrote to memory of 1628	1544	CMD.exe	154
PID 3100 wrote to memory of 2848	3100	Client.exe	155
PID 2848 wrote to memory of 3380	2848	CMD.exe	157
PID 3100 wrote to memory of 1160	3100	Client.exe	158
PID 1160 wrote to memory of 4880	1160	CMD.exe	160
PID 3100 wrote to memory of 4152	3100	Client.exe	161
PID 4152 wrote to memory of 3892	4152	CMD.exe	163
PID 3100 wrote to memory of 4616	3100	Client.exe	164
PID 4616 wrote to memory of 5096	4616	CMD.exe	166
PID 3100 wrote to memory of 3132	3100	Client.exe	167
PID 3132 wrote to memory of 404	3132	CMD.exe	169
PID 3100 wrote to memory of 2456	3100	Client.exe	170
PID 2456 wrote to memory of 5080	2456	CMD.exe	172
PID 3100 wrote to memory of 2160	3100	Client.exe	173
PID 2160 wrote to memory of 4748	2160	CMD.exe	175
PID 3100 wrote to memory of 2532	3100	Client.exe	176
PID 2532 wrote to memory of 372	2532	CMD.exe	178
PID 3100 wrote to memory of 4224	3100	Client.exe	179
PID 4224 wrote to memory of 740	4224	CMD.exe	181
PID 3100 wrote to memory of 1092	3100	Client.exe	182
PID 1092 wrote to memory of 4044	1092	CMD.exe	184
PID 3100 wrote to memory of 3796	3100	Client.exe	185
PID 3796 wrote to memory of 2732	3796	CMD.exe	187
PID 3100 wrote to memory of 4552	3100	Client.exe	188
PID 4552 wrote to memory of 1036	4552	CMD.exe	190
PID 3100 wrote to memory of 4456	3100	Client.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Corel PaintShop Pro" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Corel PaintShop Pro" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3832
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Camtasia Upgrade" /tr "C:\Windows\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Camtasia Upgrade" /tr "C:\Windows\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4500

C:\Windows\xdwdGIMP Upgrade.exe
"C:\Windows\xdwdGIMP Upgrade.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1008
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:204
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:796
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Atom Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdUnreal Engine.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3100-0-0x0000000000B70000-0x0000000000BEE000-memory.dmp

Download

memory/3100-34-0x0000000002D30000-0x0000000002D40000-memory.dmp

Download