189c456c653e587b81b4f3950b102a94c4570c2a7057c50b138b511162a2c46a

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe
Size

180KB
MD5

a26dfa9f71711828a4e5e3e6857271a7
SHA1

6b6f0282303808f6276f44669a2a4e89d9164fff
SHA256

894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92
SHA512

c753100036a0d2fd21024d5d0f46a237d02f0afdc6b3abe7e80ed539956c96e550e8beb318316c24cf90937bcbc5e33ff9ed4b09aa17794d9fb4d303f6533993
SSDEEP

3072:t2IdZhG5xJJz5cLQ6XyoF1b3CJtblKXhfRoG0U3LHRnfm7OblaUGU:t2ubG5xJJz6XRzCrb8Xhptl3LHRfmCb

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 49 IoCs

pid	Process
5084	xdwd
2448	xdwd
4924	xdwd
4984	xdwd
6048	xdwd
3964	xdwd
4548	xdwd
5804	xdwd
5628	xdwd
2888	xdwd
5936	xdwd
5256	xdwd
4588	xdwd
5660	xdwd
4024	xdwd
5656	xdwd
1052	xdwd
2416	xdwd
1276	xdwd
1324	xdwd
3012	xdwd
1544	xdwd
6012	xdwd
6008	xdwd
5632	xdwd
4856	xdwd
5644	xdwd
5904	xdwd
760	xdwd
1000	xdwd
2824	xdwd
4008	xdwd
5248	xdwd
428	xdwd
4764	xdwd
4572	xdwd
3248	xdwd
4984	xdwd
1256	xdwd
1820	xdwd
5528	xdwd
1992	xdwd
4172	xdwd
1616	xdwd
4132	xdwd
1444	xdwd
4268	xdwd
1020	xdwd
6096	xdwd

Loads dropped DLL 64 IoCs

pid	Process
5056	Process not Found
5048	Process not Found
4888	Process not Found
5084	xdwd
1984	Process not Found
4232	Process not Found
2452	Process not Found
548	Process not Found
5380	Process not Found
6068	Process not Found
5692	Process not Found
1716	Process not Found
3180	Process not Found
1768	Process not Found
2404	Process not Found
2000	Process not Found
6080	Process not Found
3120	Process not Found
3388	Process not Found
4028	Process not Found
2448	xdwd
4924	xdwd
4984	xdwd
6048	xdwd
4548	xdwd
3964	xdwd
5804	xdwd
5628	xdwd
2888	xdwd
5936	xdwd
4588	xdwd
5256	xdwd
3344	Process not Found
4240	Process not Found
5744	Process not Found
4484	Process not Found
5236	Process not Found
4988	Process not Found
4344	Process not Found
4372	Process not Found
3724	Process not Found
1616	Process not Found
2616	Process not Found
4512	Process not Found
4052	Process not Found
3500	Process not Found
4592	Process not Found
1868	Process not Found
1200	Process not Found
4640	Process not Found
1264	Process not Found
4144	Process not Found
4760	Process not Found
5204	Process not Found
2248	Process not Found
3772	Process not Found
5660	xdwd
4024	xdwd
5656	xdwd
1052	xdwd
2416	xdwd
1276	xdwd
1324	xdwd
3012	xdwd

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3552	schtasks.exe
5616	schtasks.exe
4200	schtasks.exe
5092	schtasks.exe
3724	schtasks.exe
5580	schtasks.exe
5052	schtasks.exe
1472	schtasks.exe
4440	schtasks.exe
4072	schtasks.exe
5492	schtasks.exe
2704	schtasks.exe
6076	schtasks.exe
5700	schtasks.exe
688	schtasks.exe
5948	schtasks.exe
2812	schtasks.exe
2812	schtasks.exe
3316	schtasks.exe
396	schtasks.exe
1708	schtasks.exe
3972	schtasks.exe
5932	schtasks.exe
3344	schtasks.exe
1104	schtasks.exe
3564	schtasks.exe
4368	schtasks.exe
4688	schtasks.exe
5816	schtasks.exe
6036	schtasks.exe
4912	schtasks.exe
5484	schtasks.exe
5412	schtasks.exe
4580	schtasks.exe
2572	schtasks.exe
5836	schtasks.exe
4392	schtasks.exe
8	schtasks.exe
5112	schtasks.exe
5344	schtasks.exe
5000	schtasks.exe
3492	schtasks.exe
4796	schtasks.exe
3248	schtasks.exe
5404	schtasks.exe
5548	schtasks.exe
2416	schtasks.exe
2772	schtasks.exe
5316	schtasks.exe
4144	schtasks.exe
6064	schtasks.exe
6100	schtasks.exe
1376	schtasks.exe
4668	schtasks.exe
5204	schtasks.exe
1940	schtasks.exe
4492	schtasks.exe
1912	schtasks.exe
2812	schtasks.exe
3676	schtasks.exe
6116	schtasks.exe
5040	schtasks.exe
4628	schtasks.exe
4172	schtasks.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe
Token: SeDebugPrivilege	5084	xdwd
Token: SeIncBasePriorityPrivilege	5084	xdwd
Token: SeDebugPrivilege	2448	xdwd
Token: SeDebugPrivilege	4924	xdwd
Token: SeDebugPrivilege	6048	xdwd
Token: SeDebugPrivilege	3964	xdwd
Token: SeDebugPrivilege	5804	xdwd
Token: SeDebugPrivilege	4984	xdwd
Token: SeDebugPrivilege	2888	xdwd
Token: SeDebugPrivilege	5628	xdwd
Token: SeDebugPrivilege	4588	xdwd
Token: SeDebugPrivilege	4548	xdwd
Token: SeDebugPrivilege	5936	xdwd
Token: SeDebugPrivilege	5256	xdwd
Token: SeDebugPrivilege	5660	xdwd
Token: SeDebugPrivilege	4024	xdwd
Token: SeDebugPrivilege	5656	xdwd
Token: SeDebugPrivilege	2416	xdwd
Token: SeDebugPrivilege	3012	xdwd
Token: SeDebugPrivilege	1544	xdwd
Token: SeDebugPrivilege	1324	xdwd
Token: SeDebugPrivilege	1276	xdwd
Token: SeDebugPrivilege	1052	xdwd
Token: SeDebugPrivilege	6008	xdwd
Token: SeDebugPrivilege	6012	xdwd
Token: SeDebugPrivilege	5632	xdwd
Token: SeDebugPrivilege	5904	xdwd
Token: SeDebugPrivilege	4856	xdwd
Token: SeDebugPrivilege	1000	xdwd
Token: SeDebugPrivilege	5644	xdwd
Token: SeDebugPrivilege	5248	xdwd
Token: SeDebugPrivilege	4764	xdwd
Token: SeDebugPrivilege	1820	xdwd
Token: SeDebugPrivilege	760	xdwd
Token: SeDebugPrivilege	4132	xdwd
Token: SeDebugPrivilege	4008	xdwd
Token: SeDebugPrivilege	4572	xdwd
Token: SeDebugPrivilege	5528	xdwd
Token: SeDebugPrivilege	2824	xdwd
Token: SeDebugPrivilege	1616	xdwd
Token: SeDebugPrivilege	1020	xdwd
Token: SeDebugPrivilege	1992	xdwd
Token: SeDebugPrivilege	4172	xdwd
Token: SeDebugPrivilege	1444	xdwd
Token: SeDebugPrivilege	4268	xdwd
Token: SeDebugPrivilege	3248	xdwd
Token: SeDebugPrivilege	428	xdwd
Token: SeDebugPrivilege	6096	xdwd
Token: SeDebugPrivilege	1256	xdwd
Token: SeDebugPrivilege	4984	xdwd

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 5016	4284	894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe	90
PID 4284 wrote to memory of 5016	4284	894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe	90
PID 4284 wrote to memory of 5020	4284	894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe	91
PID 4284 wrote to memory of 5020	4284	894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe	91
PID 5020 wrote to memory of 4628	5020	cmd.exe	94
PID 5020 wrote to memory of 4628	5020	cmd.exe	94
PID 5084 wrote to memory of 5892	5084	xdwd	99
PID 5084 wrote to memory of 5892	5084	xdwd	99
PID 5892 wrote to memory of 5632	5892	cmd.exe	101
PID 5892 wrote to memory of 5632	5892	cmd.exe	101
PID 5084 wrote to memory of 4588	5084	xdwd	104
PID 5084 wrote to memory of 4588	5084	xdwd	104
PID 4588 wrote to memory of 4368	4588	cmd.exe	106
PID 4588 wrote to memory of 4368	4588	cmd.exe	106
PID 5084 wrote to memory of 3528	5084	xdwd	108
PID 5084 wrote to memory of 3528	5084	xdwd	108
PID 3528 wrote to memory of 3552	3528	cmd.exe	110
PID 3528 wrote to memory of 3552	3528	cmd.exe	110
PID 5084 wrote to memory of 1452	5084	xdwd	111
PID 5084 wrote to memory of 1452	5084	xdwd	111
PID 1452 wrote to memory of 5204	1452	cmd.exe	113
PID 1452 wrote to memory of 5204	1452	cmd.exe	113
PID 5084 wrote to memory of 2848	5084	xdwd	115
PID 5084 wrote to memory of 2848	5084	xdwd	115
PID 2848 wrote to memory of 3316	2848	cmd.exe	117
PID 2848 wrote to memory of 3316	2848	cmd.exe	117
PID 5084 wrote to memory of 3092	5084	xdwd	118
PID 5084 wrote to memory of 3092	5084	xdwd	118
PID 3092 wrote to memory of 1940	3092	cmd.exe	120
PID 3092 wrote to memory of 1940	3092	cmd.exe	120
PID 5084 wrote to memory of 2968	5084	xdwd	124
PID 5084 wrote to memory of 2968	5084	xdwd	124
PID 2968 wrote to memory of 4492	2968	cmd.exe	126
PID 2968 wrote to memory of 4492	2968	cmd.exe	126
PID 5084 wrote to memory of 2372	5084	xdwd	127
PID 5084 wrote to memory of 2372	5084	xdwd	127
PID 2372 wrote to memory of 4688	2372	cmd.exe	129
PID 2372 wrote to memory of 4688	2372	cmd.exe	129
PID 5084 wrote to memory of 244	5084	xdwd	131
PID 5084 wrote to memory of 244	5084	xdwd	131
PID 244 wrote to memory of 5492	244	cmd.exe	133
PID 244 wrote to memory of 5492	244	cmd.exe	133
PID 5084 wrote to memory of 4592	5084	xdwd	137
PID 5084 wrote to memory of 4592	5084	xdwd	137
PID 4592 wrote to memory of 4796	4592	cmd.exe	139
PID 4592 wrote to memory of 4796	4592	cmd.exe	139
PID 5084 wrote to memory of 5496	5084	xdwd	140
PID 5084 wrote to memory of 5496	5084	xdwd	140
PID 5496 wrote to memory of 2704	5496	cmd.exe	142
PID 5496 wrote to memory of 2704	5496	cmd.exe	142
PID 5084 wrote to memory of 1192	5084	xdwd	143
PID 5084 wrote to memory of 1192	5084	xdwd	143
PID 1192 wrote to memory of 5412	1192	cmd.exe	145
PID 1192 wrote to memory of 5412	1192	cmd.exe	145
PID 5084 wrote to memory of 1716	5084	xdwd	158
PID 5084 wrote to memory of 1716	5084	xdwd	158
PID 1716 wrote to memory of 4944	1716	cmd.exe	160
PID 1716 wrote to memory of 4944	1716	cmd.exe	160
PID 2448 wrote to memory of 2528	2448	xdwd	161
PID 2448 wrote to memory of 2528	2448	xdwd	161
PID 2528 wrote to memory of 3316	2528	cmd.exe	163
PID 2528 wrote to memory of 3316	2528	cmd.exe	163
PID 4924 wrote to memory of 988	4924	xdwd	164
PID 4924 wrote to memory of 988	4924	xdwd	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe
"C:\Users\Admin\AppData\Local\Temp\894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name=":=@Qf9"1f@0xf3" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" enable=yes & exit
  2⤵
  PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4628

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3552
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4492
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5492
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4796
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2704
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5412
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4604
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:5792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4072
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4392
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1744
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:396
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5252
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3392
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3092
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:1008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2472
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5948
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2432
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5036
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5700
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3316

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1912

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3964
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:424
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:1140

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4460
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3248

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5804
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2392
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2416

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6076

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2888
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3040
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5404

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2772

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5256
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1628
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:3024

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4588
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4172

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5660
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4024
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5876
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5316

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3124
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4144

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1052
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4772
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5484

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1276
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3696
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2572

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1324
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:6052

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3012
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:2880

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1744
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5560
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3492

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1544
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3972

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6012
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2240
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5580

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4440

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2704
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3564

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:904
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3676

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6036

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1708

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5932

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3668
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5836

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5768
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:428
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:3204
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:2496

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3344

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6100

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2312
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5052

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5344

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1256
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:2968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:4616

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1820
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1896
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1992
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5040

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5528
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5680
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5112

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1540
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4668

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4132
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1104

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1444
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:4684
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    PID:5004

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1020
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:5292
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6096
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST & exit
  2⤵
  PID:1140
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwd.log

Filesize
1KB

MD5
f26118d675c61402c218ac6794d90a63

SHA1
ffc8d592f3ca8255ca5119eff5b576eb16ac7fac

SHA256
d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff

SHA512
6f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwd

Filesize
180KB

MD5
a26dfa9f71711828a4e5e3e6857271a7

SHA1
6b6f0282303808f6276f44669a2a4e89d9164fff

SHA256
894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92

SHA512
c753100036a0d2fd21024d5d0f46a237d02f0afdc6b3abe7e80ed539956c96e550e8beb318316c24cf90937bcbc5e33ff9ed4b09aa17794d9fb4d303f6533993

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/4284-0-0x00007FFEEDB53000-0x00007FFEEDB55000-memory.dmp

Filesize
8KB

Download
memory/4284-1-0x0000000000C70000-0x0000000000CA2000-memory.dmp

Filesize
200KB

Download
memory/4284-3-0x00007FFEEDB50000-0x00007FFEEE611000-memory.dmp

Filesize
10.8MB

Download
memory/4284-5-0x00007FFEEDB50000-0x00007FFEEE611000-memory.dmp

Filesize
10.8MB

Download
memory/4284-8-0x00007FFEEDB50000-0x00007FFEEE611000-memory.dmp

Filesize
10.8MB

Download
memory/4284-10-0x00007FFEEDB50000-0x00007FFEEE611000-memory.dmp

Filesize
10.8MB

Download
memory/5084-16-0x00007FFEEE123000-0x00007FFEEE125000-memory.dmp

Filesize
8KB

Download
memory/5084-24-0x00007FFEEE123000-0x00007FFEEE125000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads