5aefe71d92c9f8f7caea535a158be275d73d8a0fe04f50d0bb9ae751183c732b

Analysis

user interaction
yes
max time kernel
12s
max time network
14s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/04/2026, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 24KB
Sample260419-mjpsjsds4v
SHA256 5aefe71d92c9f8f7caea535a158be275d73d8a0fe04f50d0bb9ae751183c732b
MD5 75ea425edfa78fd96a6bc2b8c35b7085
SHA1 55bd0a900b40565fe3f909dc8d7495a8057236b5
SHA512 49a50a0cc2a1bb84034ae8a4aac423d6179347643c3f4d3fb0d309afcd11419f5a65b4da5499b65891ab37dd8b57860160e8731ac5d429de330c6c2f718ffef9
SSDEEP 384:9IbSEWyvuBBXNg9IpHysMNn8DB6Pj07NjOj1BKnQVfAg+dizAuKqOOTnnaQ3cKpo:GbkymBdg9I8scYyaQK4zAuqhKpo
TLSH
T1FEB2D07177988620C35C27B18D2311C1D7BC750684AB9FBDE096E3DDAC18998DA273B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe,"	ShellHost.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WindowsUpdate\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WindowsUpdate	ShellHost.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlobalFlag\GlobalFlag = "131072"	ShellHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlobalFlag	ShellHost.exe

Modifies Shared Task Scheduler registry keys 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	ShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\f0489a65-74de-418c-8e06-f7921b159894 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\dfbb5b86-6043-4a31-921f-8873ea655b80 = "C:\\Windows\\114908c0.exe"	114908c0.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	ShellHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	114908c0.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\update.exe	ShellHost.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
1104	svchost.exe
1012	ShellHost.exe
3504	114908c0.exe

Modifies file permissions 1 TTPs 25 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5752	icacls.exe
5868	icacls.exe
5952	icacls.exe
4716	icacls.exe
5640	icacls.exe
5460	icacls.exe
4756	icacls.exe
544	icacls.exe
5992	icacls.exe
904	icacls.exe
4508	icacls.exe
4764	icacls.exe
3360	icacls.exe
3520	icacls.exe
3760	icacls.exe
4944	icacls.exe
5492	icacls.exe
5412	icacls.exe
7532	icacls.exe
2820	icacls.exe
800	icacls.exe
2696	icacls.exe
2748	icacls.exe
2900	icacls.exe
5276	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\a50e0cdb	114908c0.exe
File created	C:\Windows\System32\a50e0cdb\wininit.exe	114908c0.exe
File opened for modification	C:\Windows\System32\a50e0cdb\wininit.exe	114908c0.exe
File created	C:\Windows\System32\a50e0cdb\winlogon.exe	114908c0.exe
File opened for modification	C:\Windows\System32\a50e0cdb\winlogon.exe	114908c0.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1	ShellHost.exe

Boot or Logon Autostart Execution: Time Providers 1 TTPs 2 IoCs

The Windows Time service (W32Time) enables time synchronization across and within domains.

persistence

Time Providers

T1547.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\WindowsUpdate	ShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\WindowsUpdate\DllName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\114908c0.exe	ShellHost.exe
File opened for modification	C:\Windows\114908c0.exe	ShellHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Netsh	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Netsh	114908c0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\*\shell	ShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Directory\shell\OpenWithWindowsUpdate\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{de1b435f-9a9c-48db-b216-d161f44c6eea}	114908c0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{ff019088-31fd-4805-bd94-ce48134953a8}\InprocServer32\ = "C:\\Windows\\114908c0.exe"	114908c0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{ef2d65ff-a8dd-4f26-b9e3-4d9dfa167e73}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{1bcf9785-2adc-4636-8b74-cb94708df852}\LocalServer32	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\*\shell\OpenWithWindowsUpdate	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Folder\shell\OpenWithWindowsUpdate	ShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{de1b435f-9a9c-48db-b216-d161f44c6eea}\LocalServer32\ = "C:\\Windows\\114908c0.exe"	114908c0.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\*	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Folder	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{ff019088-31fd-4805-bd94-ce48134953a8}\InprocServer32	114908c0.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Folder\shell	ShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Folder\shell\OpenWithWindowsUpdate\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Directory\shell\OpenWithWindowsUpdate	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{ef2d65ff-a8dd-4f26-b9e3-4d9dfa167e73}	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID	114908c0.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{ff019088-31fd-4805-bd94-ce48134953a8}	114908c0.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{de1b435f-9a9c-48db-b216-d161f44c6eea}\LocalServer32	114908c0.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{ef2d65ff-a8dd-4f26-b9e3-4d9dfa167e73}\InprocServer32	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\*\shell\OpenWithWindowsUpdate\command	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Directory	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Directory\shell	ShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\*\shell\OpenWithWindowsUpdate\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Folder\shell\OpenWithWindowsUpdate\command	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Directory\shell\OpenWithWindowsUpdate\command	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{1bcf9785-2adc-4636-8b74-cb94708df852}	ShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\CLSID\{1bcf9785-2adc-4636-8b74-cb94708df852}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\\ShellHost.exe"	ShellHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1936	schtasks.exe
3452	schtasks.exe
736	schtasks.exe
3096	schtasks.exe
4012	schtasks.exe
2424	schtasks.exe
3320	schtasks.exe
2160	schtasks.exe
1532	schtasks.exe
3132	schtasks.exe
4504	schtasks.exe
3516	schtasks.exe
4408	schtasks.exe
2480	schtasks.exe
3120	schtasks.exe
5032	schtasks.exe
1340	schtasks.exe
4576	schtasks.exe
3360	schtasks.exe
452	schtasks.exe
3912	schtasks.exe
4796	schtasks.exe
3844	schtasks.exe
4816	schtasks.exe
2944	schtasks.exe
3880	schtasks.exe
3228	schtasks.exe
988	schtasks.exe
1464	schtasks.exe
4860	schtasks.exe
1692	schtasks.exe
4568	schtasks.exe
2268	schtasks.exe
1868	schtasks.exe
448	schtasks.exe
3324	schtasks.exe
216	schtasks.exe
3588	schtasks.exe
2956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3504	114908c0.exe
3504	114908c0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	114908c0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 1104	3768	Client.exe	83
PID 3768 wrote to memory of 1012	3768	Client.exe	84
PID 1012 wrote to memory of 3912	1012	ShellHost.exe	85
PID 1012 wrote to memory of 2820	1012	ShellHost.exe	159
PID 1012 wrote to memory of 3504	1012	ShellHost.exe	89
PID 3504 wrote to memory of 4336	3504	114908c0.exe	90
PID 3504 wrote to memory of 800	3504	114908c0.exe	92
PID 3504 wrote to memory of 3520	3504	114908c0.exe	94
PID 3504 wrote to memory of 2696	3504	114908c0.exe	96

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	ShellHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	114908c0.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
  "C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Boot or Logon Autostart Execution: Port Monitors
  - Event Triggered Execution: Image File Execution Options Injection
  - Modifies Shared Task Scheduler registry keys
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Boot or Logon Autostart Execution: Time Providers
  - Drops file in Windows directory
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1012
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:3912
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Windows\114908c0.exe" /deny Everyone:(DE,WD)
    3⤵
    - Modifies file permissions
    PID:2820
- - C:\Windows\114908c0.exe
    "C:\Windows\114908c0.exe"
    3⤵
    - Modifies Shared Task Scheduler registry keys
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Event Triggered Execution: Netsh Helper DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3504
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdate"
      4⤵
      PID:4336
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Windows\System32\a50e0cdb\wininit.exe" /deny Everyone:(DE,WD)
      4⤵
      Modifies file permissions
      PID:800
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Windows\System32\a50e0cdb\winlogon.exe" /deny Everyone:(DE,WD)
      4⤵
      Modifies file permissions
      PID:3520
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Windows\114908c0.exe" /deny Everyone:(DE,WD)
      4⤵
      Modifies file permissions
      PID:2696
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdate" /tr "C:\Windows\114908c0.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2424
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdateStartup"
      4⤵
      PID:1940
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdateStartup" /tr "C:\Windows\114908c0.exe" /sc onstart /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2268
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdateIdle"
      4⤵
      PID:4876
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdateIdle" /tr "C:\Windows\114908c0.exe" /sc onidle /i 1 /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1868
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdateHourly"
      4⤵
      PID:4176
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdateHourly" /tr "C:\Windows\114908c0.exe" /sc hourly /mo 1 /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4860
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdateDaily"
      4⤵
      PID:2748
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdateDaily" /tr "C:\Windows\114908c0.exe" /sc daily /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3452
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdateWeekly"
      4⤵
      PID:4824
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdateWeekly" /tr "C:\Windows\114908c0.exe" /sc weekly /d MON /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2944
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdateEventSystem"
      4⤵
      PID:2896
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\114908c0.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3324
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /query /tn "WindowsUpdateEventSecurity"
      4⤵
      PID:4256
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\114908c0.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4504

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:2264
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:1556
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\2512850b.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:2748
- C:\Windows\System32\2512850b.exe
  "C:\Windows\System32\2512850b.exe"
  2⤵
  PID:2584
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:3852
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:2724
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateStartup" /tr "C:\Windows\System32\2512850b.exe" /sc onstart /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2480
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:2000
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateIdle" /tr "C:\Windows\System32\2512850b.exe" /sc onidle /i 1 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3912
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:3544
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateHourly" /tr "C:\Windows\System32\2512850b.exe" /sc hourly /mo 1 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:4544
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateDaily" /tr "C:\Windows\System32\2512850b.exe" /sc daily /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2160
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:3100
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateWeekly" /tr "C:\Windows\System32\2512850b.exe" /sc weekly /d MON /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:448
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:4188
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\System32\2512850b.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1532
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:4780
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\System32\2512850b.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:3592
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:224
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\4e249823.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:2900
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:4120
- C:\Windows\System32\4e249823.exe
  "C:\Windows\System32\4e249823.exe"
  2⤵
  PID:1048
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:4852
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:2016
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:5060
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateIdle" /tr "C:\Windows\System32\4e249823.exe" /sc onidle /i 1 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3844
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2820
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:2736
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateHourly" /tr "C:\Windows\System32\4e249823.exe" /sc hourly /mo 1 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:1408
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateDaily" /tr "C:\Windows\System32\4e249823.exe" /sc daily /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3120
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:4696
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateWeekly" /tr "C:\Windows\System32\4e249823.exe" /sc weekly /d MON /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3880
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:700
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\System32\4e249823.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5032
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:4788
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\System32\4e249823.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1464

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:2700
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:4312
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\81ac61b9.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:904
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:3368
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:4480
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:2140
- C:\Windows\System32\81ac61b9.exe
  "C:\Windows\System32\81ac61b9.exe"
  2⤵
  PID:3272
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:1316
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:4988
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:3036
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:468
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:4496
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:1388
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateWeekly" /tr "C:\Windows\System32\81ac61b9.exe" /sc weekly /d MON /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:2052
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\System32\81ac61b9.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3228
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:4116
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\System32\81ac61b9.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:452

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:2564
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:2776
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:992
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\ProgramData\26ae4d8e.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:4508
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:4504
- C:\ProgramData\26ae4d8e.exe
  "C:\ProgramData\26ae4d8e.exe"
  2⤵
  PID:2088
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:4572
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:2364
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:3040
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:3428
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:3124
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:3064
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateWeekly" /tr "C:\ProgramData\26ae4d8e.exe" /sc weekly /d MON /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4796
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:3068
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\ProgramData\26ae4d8e.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1340
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:3116
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\ProgramData\26ae4d8e.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3360

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:232
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:2628
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\5965af11.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:3760
- C:\Windows\System32\5965af11.exe
  "C:\Windows\System32\5965af11.exe"
  2⤵
  PID:376
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:2756
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:2460
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:524
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:3252
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:3956
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:788
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:1576
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\System32\5965af11.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3132
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:220
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\System32\5965af11.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3516

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:2420
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:3212
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Users\Admin\AppData\Roaming\f4dc0729.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:4764
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Roaming\f4dc0729.exe
  "C:\Users\Admin\AppData\Roaming\f4dc0729.exe"
  2⤵
  PID:4724
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:4000
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:4176
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:2724
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:4164
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:4056
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:4168
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:2628
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Users\Admin\AppData\Roaming\f4dc0729.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3588
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:2536
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Users\Admin\AppData\Roaming\f4dc0729.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:736

C:\Windows\114908c0.exe
C:\Windows\114908c0.exe
1⤵
PID:2212
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:4924
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:3104
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:4268
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:1792
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:5000
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:4180
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:4148
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\114908c0.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:216
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSecurity"
  2⤵
  PID:4292
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\114908c0.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4408

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:4036
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:116
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:4652
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\2424b321.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:4944
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:1184
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:1340
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:1508
- C:\Windows\System32\2424b321.exe
  "C:\Windows\System32\2424b321.exe"
  2⤵
  PID:4972
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:764
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:5112
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:248
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:4776
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:4932
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:4120
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:2820
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\System32\2424b321.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:4156
- - C:\Windows\System32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\System32\2424b321.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3096

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:1036
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5016
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:552
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Users\Admin\AppData\Roaming\f3a53643.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:3360
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:4364
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:736
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Roaming\f3a53643.exe
  "C:\Users\Admin\AppData\Roaming\f3a53643.exe"
  2⤵
  PID:4548
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:1004
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:4596
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:4336
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:992
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:4436
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:1380
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:2412
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:4616
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Users\Admin\AppData\Roaming\f3a53643.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:988

C:\Windows\System32\2512850b.exe
C:\Windows\System32\2512850b.exe
1⤵
PID:4900
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:2064
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:1184
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:1896
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:4828
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:2384
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:4652
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:1976
- C:\Windows\System32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdateEventSystem" /tr "C:\Windows\System32\2512850b.exe" /sc onevent /ec System /mo *[System[EventID=1]] /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4568
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSecurity"
  2⤵
  PID:548
- C:\Windows\System32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\System32\2512850b.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4012

C:\Windows\System32\4e249823.exe
C:\Windows\System32\4e249823.exe
1⤵
PID:3620
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:4928
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:2748
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:320
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:5052
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:3972
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:2988
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:4480
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSecurity"
  2⤵
  PID:5020
- C:\Windows\System32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdateEventSecurity" /tr "C:\Windows\System32\4e249823.exe" /sc onevent /ec Security /mo *[System[EventID=4624]] /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1936

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:2464
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5076
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\ca7a7035.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5276
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:5424
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:5860
- C:\Windows\System32\ca7a7035.exe
  "C:\Windows\System32\ca7a7035.exe"
  2⤵
  PID:5892
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:6092
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:5468
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:5784
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:4224
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:6484
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:6508
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:5236
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:6372

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:2140
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5152
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\SysWOW64\a43a1ff3.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5492
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:5516
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:5920
- C:\Windows\SysWOW64\a43a1ff3.exe
  "C:\Windows\SysWOW64\a43a1ff3.exe"
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:5564
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:6952
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:1976

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:5200
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5320
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\ProgramData\014b231f.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5752
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:5772
- C:\ProgramData\014b231f.exe
  "C:\ProgramData\014b231f.exe"
  2⤵
  PID:4376
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:5416
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:5512
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:6348
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:5464
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:6080
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:3908
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:6852
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:3640

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:5392
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5536
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\1fa8602a.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5952
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:6004
- C:\Windows\System32\1fa8602a.exe
  "C:\Windows\System32\1fa8602a.exe"
  2⤵
  PID:5544
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:5980
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:5568
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:5936
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:952
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:7004
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:6712
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:6212
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:2728

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:5400
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5628
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\2ec9eda7.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5868
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:1976
- C:\Windows\System32\2ec9eda7.exe
  "C:\Windows\System32\2ec9eda7.exe"
  2⤵
  PID:5180
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:5816
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:4256
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:6400
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:3068
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:2628
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:6664
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:4156
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:5424

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:3092
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:3908
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\718a2bb6.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:4716
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:5944
- C:\Windows\System32\718a2bb6.exe
  "C:\Windows\System32\718a2bb6.exe"
  2⤵
  PID:6164
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:6308
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:6976
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:6384
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:6340
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:5924
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:6360
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:6336
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:5436

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:3136
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5300
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\a6df31b4.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5460
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:5456
- C:\Windows\System32\a6df31b4.exe
  "C:\Windows\System32\a6df31b4.exe"
  2⤵
  PID:6432
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:6572
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:6152
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:6904
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:2440
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:5396
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:6220
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:5868
- - C:\Windows\System32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:5760

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:5624
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5308
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\SysWOW64\ff532807.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5640
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:5484
- C:\Windows\SysWOW64\ff532807.exe
  "C:\Windows\SysWOW64\ff532807.exe"
  2⤵
  PID:6440
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:6628
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:5388
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:6584
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:6916
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:6608

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:4456
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5756
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\SysWOW64\c8a53745.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5412
- C:\Windows\SysWOW64\c8a53745.exe
  "C:\Windows\SysWOW64\c8a53745.exe"
  2⤵
  PID:6776
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:7108
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:6824
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:6764
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:6404
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:7112

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:4824
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5956
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Users\Admin\AppData\Roaming\2aec1fc1.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:544
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:6260
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:6784
- C:\Users\Admin\AppData\Roaming\2aec1fc1.exe
  "C:\Users\Admin\AppData\Roaming\2aec1fc1.exe"
  2⤵
  PID:6856
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:7092
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:3480
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:6032
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:6980
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:5952
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:2776
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:6148
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:5152

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:5316
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5612
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\ProgramData\b0c17382.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:4756
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:6356
- C:\ProgramData\b0c17382.exe
  "C:\ProgramData\b0c17382.exe"
  2⤵
  PID:6812
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:7044
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:2432
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:5132
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:5292
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateDaily"
    3⤵
    PID:6180
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateWeekly"
    3⤵
    PID:6416
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSystem"
    3⤵
    PID:5676
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateEventSecurity"
    3⤵
    PID:6284
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:6828

C:\Windows\System32\81ac61b9.exe
C:\Windows\System32\81ac61b9.exe
1⤵
PID:6492
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:6708
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:6356
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:5956
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:7060
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:64

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:6732
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:6928
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\66600479.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:5992
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:3820
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:6800
- C:\Windows\66600479.exe
  "C:\Windows\66600479.exe"
  2⤵
  PID:6128
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdate"
    3⤵
    PID:3384
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateStartup"
    3⤵
    PID:5220
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateIdle"
    3⤵
    PID:6248
- - C:\Windows\system32\schtasks.exe
    "schtasks" /query /tn "WindowsUpdateHourly"
    3⤵
    PID:2540
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:6040

C:\Windows\System32\2424b321.exe
C:\Windows\System32\2424b321.exe
1⤵
PID:5616
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5580
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:4920
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:6920
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:6216
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:4784
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:6900
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:5772
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSecurity"
  2⤵
  PID:5688

C:\Users\Admin\AppData\Roaming\f4dc0729.exe
C:\Users\Admin\AppData\Roaming\f4dc0729.exe
1⤵
PID:5492
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5732
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:6808
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:5296
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:2680
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:5584
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:6532
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:6620
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSecurity"
  2⤵
  PID:6264

C:\ProgramData\26ae4d8e.exe
C:\ProgramData\26ae4d8e.exe
1⤵
PID:5508
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5824
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:544
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:1288
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:5128
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:5452
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:6872
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:6028
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSecurity"
  2⤵
  PID:6676

C:\Windows\System32\5965af11.exe
C:\Windows\System32\5965af11.exe
1⤵
PID:4804
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:6536
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:2968
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:5916
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:5944
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:5548
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:6132
- C:\Windows\System32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:6848

C:\Users\Admin\AppData\Roaming\f3a53643.exe
C:\Users\Admin\AppData\Roaming\f3a53643.exe
1⤵
PID:7148
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5088
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateStartup"
  2⤵
  PID:5160
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateIdle"
  2⤵
  PID:4628
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateHourly"
  2⤵
  PID:4756
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateDaily"
  2⤵
  PID:5804
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateWeekly"
  2⤵
  PID:5404
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSystem"
  2⤵
  PID:6576
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdateEventSecurity"
  2⤵
  PID:6604

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:2900
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5908

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:5524
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5540

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:6640
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:6740
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Users\Admin\AppData\Roaming\865e6d24.exe" /deny Everyone:(DE,WD)
  2⤵
  - Modifies file permissions
  PID:7532

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:6796
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:6928

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:6088
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:6176

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:6932
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5884

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:6760
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:5176

C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
1⤵
PID:6448
- C:\Windows\system32\schtasks.exe
  "schtasks" /query /tn "WindowsUpdate"
  2⤵
  PID:7392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Time Providers

T1547.003

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Time Providers

T1547.003

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ShellHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ShellHost.exe.log
Size 226B
SHA256 1ac8854abd01c202cf82e4ccdf80bf50319c59bc7a02dce2b19cecfedf7dd4ba
MD5 b92bd19c1a9416298a873dfa43b439b7
SHA1 7b96a8874aff3a502363f4168332613ebc53d64e
SHA512 5910691ebdd78a2740117b14f146629874682d196f518f479b8bcb754ed2501a009fc465cb9e3685f7aed8ced7b435690de2b8b8439117abb5f61dc4996387a6
TLSH
T10AD0233033D0A0C184033F44141C234841FF820171209F303838114CD4362373B311F3
MD5 SHA1 SHA512 TLSH

Submit Download

ShellHost.exe

Path C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\ShellHost.exe
Size 26KB
SHA256 4f774971f7f6ead08bf20faf0e4466302048ee3b6136b23c1235088b26c581f6
MD5 2e3cc5ba6e72ace7b3073b8e0e81a740
SHA1 5b080e058e15e4d96fa05c99790f8501bc926251
SHA512 1fe36a88beb3376a9d7b08e7a096073e57643c1701ece14a7e51c5afc6df84e0f0f5c0587aed7609ce49826fa322961a0e2077a9b5c7b3872c7b7669a4d61c54
SSDEEP 768:Ubndg4SicQMWma4eLDScvUbLrK8ujjuQtr:n4SicQMWm6ScvUbLrjujjr
TLSH
T178C25101F3F84519F7BF9B3458B59A151232F99B0E22CA8E0D56418D0977BB2DA31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\sfx_b835d328-c6f6-473c-8a96-e1de2b7d29ea\svchost.exe
Size 15KB
SHA256 e94eaae45af8eed5f921636d87f954816dd2618da99fdffb378a579114c77746
MD5 47ddeb83be4253194d564ce47ecac84a
SHA1 095a262f8b638db4815ef177a2eeeab2b9a835b6
SHA512 38b8ce4201e6f65b99b835133747b72a5ecc75374de27ae55995b5ea300f3d5c33c4e88dee8fd7cb30e16fb01cb717f73b586700ba7fb40fcf015121d5957cc3
SSDEEP 384:HO2IeT18l3DziHT8Bzk4g5W2A65P0Nd7SegW:F8JGHoBzk3r54d7Rg
TLSH
T19A622A03BF414DA2D3B045B418B4E99A817BBD311F25BAD77B808E6E0575AC1EC35E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-59-0x0000000001630000-0x000000000165F000-memory.dmp

Download

memory/1012-35-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

Download

memory/1012-39-0x0000000001780000-0x00000000017AF000-memory.dmp

Download

memory/1036-68-0x0000000001220000-0x000000000124F000-memory.dmp

Download

memory/1048-125-0x0000000001430000-0x000000000143C000-memory.dmp

Download

memory/2140-79-0x0000000000F30000-0x0000000000F5F000-memory.dmp

Download

memory/2264-43-0x0000000000A60000-0x0000000000A8F000-memory.dmp

Download

memory/2420-62-0x00000000007D0000-0x00000000007FF000-memory.dmp

Download

memory/2464-76-0x0000000001530000-0x000000000155F000-memory.dmp

Download

memory/2564-56-0x0000000000E60000-0x0000000000E8F000-memory.dmp

Download

memory/2584-122-0x0000000000660000-0x000000000068F000-memory.dmp

Download

memory/2700-51-0x0000000000D30000-0x0000000000D5F000-memory.dmp

Download

memory/3092-92-0x0000000001280000-0x00000000012AF000-memory.dmp

Download

memory/3136-96-0x00000000011F0000-0x000000000121F000-memory.dmp

Download

memory/3504-113-0x0000000002610000-0x000000000261C000-memory.dmp

Download

memory/3504-112-0x0000000000F90000-0x0000000000FBF000-memory.dmp

Download

memory/3592-46-0x00000000016F0000-0x000000000171F000-memory.dmp

Download

memory/3768-3-0x0000000000C40000-0x0000000000C52000-memory.dmp

Download

memory/3768-49-0x0000000000950000-0x000000000097F000-memory.dmp

Download

memory/3768-1-0x0000000000BF0000-0x0000000000BFA000-memory.dmp

Download

memory/3768-4-0x0000000000C90000-0x0000000000CA0000-memory.dmp

Download

memory/3768-0-0x0000000000420000-0x0000000000428000-memory.dmp

Download

memory/4036-65-0x0000000000A40000-0x0000000000A6F000-memory.dmp

Download

memory/4456-102-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/4824-104-0x00000000012E0000-0x000000000130F000-memory.dmp

Download

memory/5200-81-0x0000000001500000-0x000000000152F000-memory.dmp

Download

memory/5316-103-0x0000000000C30000-0x0000000000C5F000-memory.dmp

Download

memory/5392-87-0x0000000001420000-0x000000000144F000-memory.dmp

Download

memory/5400-85-0x00000000015A0000-0x00000000015CF000-memory.dmp

Download

memory/5624-97-0x0000000001610000-0x000000000163F000-memory.dmp

Download

memory/6732-110-0x0000000001300000-0x000000000132F000-memory.dmp

Download