ba67f398fb2c5f91c1c227725fec68eba38a9f6c81a425450baf1b94037fe77e

Analysis

max time kernel
599s
max time network
603s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
30-10-2024 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Client.exe
Size

65KB
MD5

1bcb0ce08d34ba620819df0268e04011
SHA1

296765a47aa584a24bf66ddc9e67356e3203fac8
SHA256

ba67f398fb2c5f91c1c227725fec68eba38a9f6c81a425450baf1b94037fe77e
SHA512

f3409246d7cf16d9902d3420f6e5048e87859484e85a25eebc4559ddc6d26e9b40843b78b3a056c24e1bd9efc13d609f1a9ef37387789cb6994b84c7e4bd0145
SSDEEP

1536:MKqK4Tm4BoN36t4QviFw1AjHkBnvAffLteF3nLrB9z3nIaF9bXS9vM:MKqK4C4BoN36t4QviFC8EBnYfWl9zYab

Score

10^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Client.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\discord.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 12 IoCs

Processes:

svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exeClient.exesvhost.exesvhost.exesvhost.exe

pid	Process
1748	svhost.exe
3980	svhost.exe
1216	svhost.exe
2764	svhost.exe
648	svhost.exe
3696	svhost.exe
2592	svhost.exe
8	svhost.exe
4864	Client.exe
1984	svhost.exe
1004	svhost.exe
436	svhost.exe

Loads dropped DLL 64 IoCs

Processes:

WmiApSrv.exe

pid	Process
4452
3952
3984
952
3108
4956
3520	WmiApSrv.exe
1328
1604
2804
4620
248
4852
2684
2536
3744
2872
5020
4292
1424
3732
1708
412
4872
3992
4376
4552
712
4124
5048
3440
4040
4900
4312
5004
1752
2900
2720
4832
1996
4972
2200
1744
1936
5108
2308
4680
3304
4828
5080
1880
1148
2104
1996
3096
4812
4260
4836
4784
4820
1520
1708
3904
1524

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svhost.exeClient.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\Documents\\SU.exe"	Client.exe

Drops file in Program Files directory 2 IoCs

Processes:

Client.exe

description	ioc	Process
File created	C:\Program Files\discord.exe	Client.exe
File opened for modification	C:\Program Files\discord.exe	Client.exe

Drops file in Windows directory 1 IoCs

Processes:

Client.exe

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

svhost.exetaskkill.exetaskkill.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exesvhost.exesvhost.exetaskkill.exetaskkill.exesvhost.exesvhost.exeschtasks.exetaskkill.exeschtasks.exeNew Client.exeschtasks.exesvhost.exeschtasks.execmd.exeschtasks.exesvhost.exetaskkill.exeschtasks.exeschtasks.exetaskkill.exetaskkill.exesvhost.exeschtasks.exechoice.exesvhost.exeschtasks.exetaskkill.exeschtasks.exetaskkill.exesvhost.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exesvhost.exeschtasks.exeschtasks.exetaskkill.exeschtasks.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 11 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
3600	taskkill.exe
3288	taskkill.exe
1428	taskkill.exe
5024	taskkill.exe
1784	taskkill.exe
1096	taskkill.exe
4768	taskkill.exe
2788	taskkill.exe
4760	taskkill.exe
2040	taskkill.exe
4872	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
4752	schtasks.exe
1240	schtasks.exe
1952	schtasks.exe
4752	schtasks.exe
3116	schtasks.exe
1144	schtasks.exe
2268	schtasks.exe
1524	schtasks.exe
3500	schtasks.exe
4976	schtasks.exe
4740	schtasks.exe
4984	schtasks.exe
1208	schtasks.exe
3584	schtasks.exe
3808	schtasks.exe
1984	schtasks.exe
2120	schtasks.exe
3740	schtasks.exe
4840	schtasks.exe
3080	schtasks.exe
4892	schtasks.exe
1828	schtasks.exe
1244	schtasks.exe
1876	schtasks.exe
3792	schtasks.exe
3316	schtasks.exe
3360	schtasks.exe
4968	schtasks.exe
1532	schtasks.exe
4964	schtasks.exe
3128	schtasks.exe
564	schtasks.exe
1916	schtasks.exe
4904	schtasks.exe
2020	schtasks.exe
4532	schtasks.exe
4956	schtasks.exe
4036	schtasks.exe
3208	schtasks.exe
3880	schtasks.exe
3064	schtasks.exe
2500	schtasks.exe
612	schtasks.exe
772	schtasks.exe
1236	schtasks.exe
1448	schtasks.exe
3920	schtasks.exe
3804	schtasks.exe
4916	schtasks.exe
3664	schtasks.exe
4948	schtasks.exe
4840	schtasks.exe
1752	schtasks.exe
2276	schtasks.exe
3496	schtasks.exe
2684	schtasks.exe
5016	schtasks.exe
3376	schtasks.exe
3656	schtasks.exe
1020	schtasks.exe
1488	schtasks.exe
2024	schtasks.exe
3148	schtasks.exe
4832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Client.exeWmiApSrv.exe

pid	Process
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
3520	WmiApSrv.exe
3520	WmiApSrv.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe
4864	Client.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svhost.exe

description	pid	Process
Token: SeDebugPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1748	svhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

New Client.execmd.exesvhost.exe

description	pid	Process	procid_target
PID 2760 wrote to memory of 1748	2760	New Client.exe	78
PID 2760 wrote to memory of 1748	2760	New Client.exe	78
PID 2760 wrote to memory of 1748	2760	New Client.exe	78
PID 2760 wrote to memory of 648	2760	New Client.exe	79
PID 2760 wrote to memory of 648	2760	New Client.exe	79
PID 2760 wrote to memory of 648	2760	New Client.exe	79
PID 648 wrote to memory of 3284	648	cmd.exe	81
PID 648 wrote to memory of 3284	648	cmd.exe	81
PID 648 wrote to memory of 3284	648	cmd.exe	81
PID 1748 wrote to memory of 1096	1748	svhost.exe	82
PID 1748 wrote to memory of 1096	1748	svhost.exe	82
PID 1748 wrote to memory of 1096	1748	svhost.exe	82
PID 1748 wrote to memory of 3088	1748	svhost.exe	84
PID 1748 wrote to memory of 3088	1748	svhost.exe	84
PID 1748 wrote to memory of 3088	1748	svhost.exe	84
PID 1748 wrote to memory of 2796	1748	svhost.exe	86
PID 1748 wrote to memory of 2796	1748	svhost.exe	86
PID 1748 wrote to memory of 2796	1748	svhost.exe	86
PID 1748 wrote to memory of 3600	1748	svhost.exe	89
PID 1748 wrote to memory of 3600	1748	svhost.exe	89
PID 1748 wrote to memory of 3600	1748	svhost.exe	89
PID 1748 wrote to memory of 2112	1748	svhost.exe	91
PID 1748 wrote to memory of 2112	1748	svhost.exe	91
PID 1748 wrote to memory of 2112	1748	svhost.exe	91
PID 1748 wrote to memory of 3808	1748	svhost.exe	93
PID 1748 wrote to memory of 3808	1748	svhost.exe	93
PID 1748 wrote to memory of 3808	1748	svhost.exe	93
PID 1748 wrote to memory of 3288	1748	svhost.exe	95
PID 1748 wrote to memory of 3288	1748	svhost.exe	95
PID 1748 wrote to memory of 3288	1748	svhost.exe	95
PID 1748 wrote to memory of 2168	1748	svhost.exe	97
PID 1748 wrote to memory of 2168	1748	svhost.exe	97
PID 1748 wrote to memory of 2168	1748	svhost.exe	97
PID 1748 wrote to memory of 3964	1748	svhost.exe	99
PID 1748 wrote to memory of 3964	1748	svhost.exe	99
PID 1748 wrote to memory of 3964	1748	svhost.exe	99
PID 1748 wrote to memory of 4768	1748	svhost.exe	107
PID 1748 wrote to memory of 4768	1748	svhost.exe	107
PID 1748 wrote to memory of 4768	1748	svhost.exe	107
PID 1748 wrote to memory of 784	1748	svhost.exe	109
PID 1748 wrote to memory of 784	1748	svhost.exe	109
PID 1748 wrote to memory of 784	1748	svhost.exe	109
PID 1748 wrote to memory of 732	1748	svhost.exe	111
PID 1748 wrote to memory of 732	1748	svhost.exe	111
PID 1748 wrote to memory of 732	1748	svhost.exe	111
PID 1748 wrote to memory of 1428	1748	svhost.exe	113
PID 1748 wrote to memory of 1428	1748	svhost.exe	113
PID 1748 wrote to memory of 1428	1748	svhost.exe	113
PID 1748 wrote to memory of 4300	1748	svhost.exe	115
PID 1748 wrote to memory of 4300	1748	svhost.exe	115
PID 1748 wrote to memory of 4300	1748	svhost.exe	115
PID 1748 wrote to memory of 2216	1748	svhost.exe	117
PID 1748 wrote to memory of 2216	1748	svhost.exe	117
PID 1748 wrote to memory of 2216	1748	svhost.exe	117
PID 1748 wrote to memory of 2788	1748	svhost.exe	119
PID 1748 wrote to memory of 2788	1748	svhost.exe	119
PID 1748 wrote to memory of 2788	1748	svhost.exe	119
PID 1748 wrote to memory of 760	1748	svhost.exe	121
PID 1748 wrote to memory of 760	1748	svhost.exe	121
PID 1748 wrote to memory of 760	1748	svhost.exe	121
PID 1748 wrote to memory of 4944	1748	svhost.exe	123
PID 1748 wrote to memory of 4944	1748	svhost.exe	123
PID 1748 wrote to memory of 4944	1748	svhost.exe	123
PID 1748 wrote to memory of 4864	1748	svhost.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\New Client.exe
"C:\Users\Admin\AppData\Local\Temp\New Client.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Users\Admin\Pictures\Camera Roll\Client.exe
    "C:\Users\Admin\Pictures\Camera Roll\Client.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4864
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Program Files\discord.exe" & exit
      4⤵
      PID:1232
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Program Files\discord.exe"
        5⤵
        
        PID:2096
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2492
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3208
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1152
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:3084
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3884
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:3424
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:5084
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1020
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4596
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:3892
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:5116
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4904
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:1480
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:1976
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3260
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:3504
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2688
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:5080
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1832
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:3916
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:5040
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3496
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1028
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4516
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4816
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1952
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2980
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1828
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3396
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2024
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3884
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:2992
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4168
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4984
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4916
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1984
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:5116
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2120
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1848
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4444
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4460
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4740
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:404
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1208
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:840
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:3416
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4252
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4316
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:1088
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2684
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1112
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3740
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4136
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4752
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2384
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4840
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3396
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:4648
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4940
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5016
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:5112
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:232
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2592
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:3980
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:740
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:1604
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2804
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:400
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2448
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:1880
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1244
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3792
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:1600
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:1544
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:5040
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4036
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:1960
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3080
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1528
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:612
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2040
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2020
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3988
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3664
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3164
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4916
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4884
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:232
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2972
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4948
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1916
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1140
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:1064
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3880
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3700
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1524
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3068
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:4248
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:848
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4376
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:924
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3128
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1684
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4240
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3300
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4752
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2200
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4840
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2992
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3116
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:5000
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1004
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4384
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3360
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4884
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4596
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3140
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:2060
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1140
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:3568
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4424
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:5060
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1280
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:792
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:1132
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4532
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2448
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4060
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2428
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:3456
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2472
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3064
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2068
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:4380
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1656
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3376
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3256
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:772
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2992
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1936
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4392
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:3108
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2324
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4956
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4444
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3656
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4080
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1020
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:400
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1752
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:412
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1236
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4216
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:4532
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3416
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1244
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:972
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4036
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3728
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4832
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3772
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1144
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1344
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1920
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3664
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4892
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3440
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:2316
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3108
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1532
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2324
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1448
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4880
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:3076
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1540
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4424
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3820
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3804
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2016
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:2076
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4532
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:1576
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1368
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:956
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:712
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3584
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3624
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3500
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3796
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:2204
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1672
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2500
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4916
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3316
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4292
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1448
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:2452
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1916
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3572
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2276
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4720
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:252
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4780
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4776
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3232
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:4532
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:956
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4976
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:428
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1876
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:1820
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2268
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3500
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:2536
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4660
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1760
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:3484
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3148
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:4260
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:1936
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4956
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        
        PID:3108
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2124
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4040
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4948
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1240
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:2456
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4968
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:4880
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4964
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3684
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4692
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST & exit
      4⤵
      PID:1132
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Windows Update" /tr "C:\Program Files\discord.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:564
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST & exit
      4⤵
      PID:3792
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Windows Update " /tr "C:\Users\Admin\Documents\SU.exe" /RL HIGHEST
        5⤵
        
        PID:4128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3284

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3980

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1216

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:648

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3696

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3520

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svhost.exe.log

Filesize
319B

MD5
2a0834560ed3770fc33d7a42f8229722

SHA1
c8c85f989e7a216211cf9e4ce90b0cc95354aa53

SHA256
8aa2d836004258f1a1195dc4a96215b685aed0c46a261a2860625d424e9402b6

SHA512
c5b64d84e57eb8cc387b5feedf7719f1f7ae21f6197169f5f73bc86deddb538b9af3c9952c94c4f69ae956e1656d11ab7441c292d2d850a4d2aaa9ec678f8e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
65KB

MD5
1bcb0ce08d34ba620819df0268e04011

SHA1
296765a47aa584a24bf66ddc9e67356e3203fac8

SHA256
ba67f398fb2c5f91c1c227725fec68eba38a9f6c81a425450baf1b94037fe77e

SHA512
f3409246d7cf16d9902d3420f6e5048e87859484e85a25eebc4559ddc6d26e9b40843b78b3a056c24e1bd9efc13d609f1a9ef37387789cb6994b84c7e4bd0145

Download Submit
C:\Users\Admin\Pictures\Camera Roll\Client.exe

Filesize
558KB

MD5
64d37a6853cdcff6a20e6dca51d7e1bd

SHA1
d04853d30c2e34a984ded4d86262279e09f461a0

SHA256
12958a9be57b2152337892bdfbd8ff878eb02e235f492de5237e0ffc359ff38a

SHA512
b73c5350ea3036ee322d055da68e923eeb248cb8e7b1a6744be16ebafc86a0e3d3a53a45047d3cc01ba458084b24c2c70b33d0d7bb3de4cb5c23648b151c3f6b

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1748-13-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/1748-14-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/1748-17-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/2760-2-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/2760-16-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/2760-1-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/2760-0-0x00000000746C1000-0x00000000746C2000-memory.dmp

Filesize
4KB

Download
memory/4864-38-0x0000000000EF0000-0x0000000000F82000-memory.dmp

Filesize
584KB

Download
memory/4864-1423-0x000000001C760000-0x000000001C7D6000-memory.dmp

Filesize
472KB

Download
memory/4864-1424-0x00000000017C0000-0x00000000017CC000-memory.dmp

Filesize
48KB

Download
memory/4864-1425-0x00000000017F0000-0x000000000180E000-memory.dmp

Filesize
120KB

Download