sheetrat | 5dd43095d776ec91ac49a1974da75000d61167ae79181a38ba9252c3caa424a7

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ElysiumExeFree.exe
Size 598KB
Sample260620-s5ateag12x
SHA256 5dd43095d776ec91ac49a1974da75000d61167ae79181a38ba9252c3caa424a7
MD5 0bcec7ffedc63ca3e6a9658ab41e2240
SHA1 cf90986f4a9e235825259c8a1ddcaaed5674070e
SHA512 8f863dc5a2883f026342c59c3abf632bfe5c68ef8da55e678fcabdccf8974c50dc7d52e7f4cabe70649b4c39cf3016eb2f6e7ca23f3cdafe48b7c838c4a79ef4
SSDEEP 12288:s4v7r++Hla8cG8SstrhFoo+FU4XLutmTn+AS7EtVlq53q1Kzx:HflHsG8tX+wtmD+AYEWqsd
TLSH
T149D4232A9E01E937DF9A67723C993488F02AB3431DE5BA0B9AF3D1D11513F6217A59C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_mvllprzzib execution sheetrat xbinder loader persistence privilege_escalation trojan

Malware Config

Extracted

Family

xbinder

Mutex

Uue3yiHwupZlXS4eC

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
ElysiumExeFree.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
SystemInfoCap.exe

Extracted

Family

sheetrat

Version

Campaign

Sheet_mvllprzzib

bin-declined.gl.at.ply.gg:1554

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000d00000001c5f1-9.dat	family_sheetrat_v4
behavioral2/memory/560-14-0x0000000000CD0000-0x0000000000D68000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdNetwork.exe"	SystemInfoCap.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 64 IoCs

pid	Process
560	SystemInfoCap.exe
1160	SystemInfoCap.exe
4288	SystemInfoCap.exe
3372	SystemInfoCap.exe
2984	SystemInfoCap.exe
2312	SystemInfoCap.exe
5320	SystemInfoCap.exe
264	SystemInfoCap.exe
4908	xdwdNetwork.exe
2436	xdwdSystemInfoCap.exe
3792	SystemInfoCap.exe
6000	SystemInfoCap.exe
792	SystemInfoCap.exe
2904	SystemInfoCap.exe
4896	SystemInfoCap.exe
4732	SystemInfoCap.exe
4768	SystemInfoCap.exe
2820	SystemInfoCap.exe
3924	SystemInfoCap.exe
4220	xdwdNetwork.exe
4392	SystemInfoCap.exe
5916	SystemInfoCap.exe
2364	SystemInfoCap.exe
2724	SystemInfoCap.exe
720	SystemInfoCap.exe
296	SystemInfoCap.exe
1848	SystemInfoCap.exe
5352	SystemInfoCap.exe
3808	SystemInfoCap.exe
5528	SystemInfoCap.exe
4648	SystemInfoCap.exe
4212	SystemInfoCap.exe
1396	SystemInfoCap.exe
5864	SystemInfoCap.exe
4544	SystemInfoCap.exe
1756	SystemInfoCap.exe
4600	SystemInfoCap.exe
1172	SystemInfoCap.exe
1416	SystemInfoCap.exe
4132	SystemInfoCap.exe
3156	SystemInfoCap.exe
5360	SystemInfoCap.exe
5144	SystemInfoCap.exe
3116	SystemInfoCap.exe
5444	SystemInfoCap.exe
4636	SystemInfoCap.exe
4804	SystemInfoCap.exe
6108	SystemInfoCap.exe
2548	SystemInfoCap.exe
3856	SystemInfoCap.exe
1852	SystemInfoCap.exe
3196	SystemInfoCap.exe
5140	SystemInfoCap.exe
5656	SystemInfoCap.exe
1828	SystemInfoCap.exe
5616	SystemInfoCap.exe
3152	SystemInfoCap.exe
4820	SystemInfoCap.exe
248	SystemInfoCap.exe
5492	SystemInfoCap.exe
1068	SystemInfoCap.exe
3052	SystemInfoCap.exe
2540	SystemInfoCap.exe
5668	SystemInfoCap.exe

Loads dropped DLL 64 IoCs

pid	Process
1560	Process not Found
4908	xdwdNetwork.exe
4300	Process not Found
6088	Process not Found
2436	xdwdSystemInfoCap.exe
4396	ElysiumExeFree.exe
3792	SystemInfoCap.exe
5916	Process not Found
4640	Process not Found
2756	ElysiumExeFree.exe
6000	SystemInfoCap.exe
1620	Process not Found
2424	Process not Found
5480	ElysiumExeFree.exe
792	SystemInfoCap.exe
4604	Process not Found
3932	Process not Found
2724	Process not Found
5024	ElysiumExeFree.exe
2904	SystemInfoCap.exe
5572	Process not Found
3688	Process not Found
1388	ElysiumExeFree.exe
4896	SystemInfoCap.exe
5948	Process not Found
4392	Process not Found
5188	Process not Found
1096	ElysiumExeFree.exe
980	Process not Found
4732	SystemInfoCap.exe
3184	Process not Found
976	ElysiumExeFree.exe
4768	SystemInfoCap.exe
4596	Process not Found
2100	Process not Found
1236	Process not Found
4224	Process not Found
4572	Process not Found
4892	ElysiumExeFree.exe
2820	SystemInfoCap.exe
4160	Process not Found
4848	Process not Found
1820	Process not Found
2544	Process not Found
1140	ElysiumExeFree.exe
3924	SystemInfoCap.exe
5128	Process not Found
4220	xdwdNetwork.exe
2748	ElysiumExeFree.exe
4392	SystemInfoCap.exe
6028	Process not Found
6108	Process not Found
1848	Process not Found
3184	Process not Found
2648	ElysiumExeFree.exe
5916	SystemInfoCap.exe
5360	Process not Found
460	Process not Found
1104	ElysiumExeFree.exe
2364	SystemInfoCap.exe
5172	Process not Found
3396	Process not Found
3300	Process not Found
3004	ElysiumExeFree.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\Windows\\xdwdSystemInfoCap.exe"	SystemInfoCap.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	xdwdSystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File created	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	xdwdNetwork.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	xdwdSystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdSystemInfoCap.exe	SystemInfoCap.exe
File opened for modification	C:\Windows\xdwdNetwork.exe	SystemInfoCap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2988	schtasks.exe
460	schtasks.exe
6016	schtasks.exe
2444	schtasks.exe
2100	schtasks.exe
1584	schtasks.exe
3208	schtasks.exe
5028	schtasks.exe
5932	schtasks.exe
2536	schtasks.exe
1152	schtasks.exe
3032	schtasks.exe
4280	schtasks.exe
4160	schtasks.exe
2068	schtasks.exe
5544	schtasks.exe
4928	schtasks.exe
2584	schtasks.exe
3708	schtasks.exe
5456	schtasks.exe
5824	schtasks.exe
5572	schtasks.exe
1216	schtasks.exe
3416	schtasks.exe
2296	schtasks.exe
6136	schtasks.exe
5240	schtasks.exe
4736	schtasks.exe
368	schtasks.exe
5252	schtasks.exe
5356	schtasks.exe
5324	schtasks.exe
4104	schtasks.exe
4788	schtasks.exe
1100	schtasks.exe
5328	schtasks.exe
1428	schtasks.exe
5032	schtasks.exe
4980	schtasks.exe
612	schtasks.exe
2164	schtasks.exe
2940	schtasks.exe
3496	schtasks.exe
5572	schtasks.exe
5428	schtasks.exe
2576	schtasks.exe
4916	schtasks.exe
4284	schtasks.exe
1524	schtasks.exe
4592	schtasks.exe
5652	schtasks.exe
5232	schtasks.exe
3320	schtasks.exe
2076	schtasks.exe
3208	schtasks.exe
2732	schtasks.exe
2508	schtasks.exe
5840	schtasks.exe
1040	schtasks.exe
3252	schtasks.exe
2464	schtasks.exe
3972	schtasks.exe
6136	schtasks.exe
2140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4396	ElysiumExeFree.exe
4396	ElysiumExeFree.exe
3792	SystemInfoCap.exe
3792	SystemInfoCap.exe
2756	ElysiumExeFree.exe
2756	ElysiumExeFree.exe
6000	SystemInfoCap.exe
6000	SystemInfoCap.exe
5480	ElysiumExeFree.exe
5480	ElysiumExeFree.exe
792	SystemInfoCap.exe
792	SystemInfoCap.exe
5024	ElysiumExeFree.exe
5024	ElysiumExeFree.exe
2904	SystemInfoCap.exe
2904	SystemInfoCap.exe
1388	ElysiumExeFree.exe
1388	ElysiumExeFree.exe
4896	SystemInfoCap.exe
4896	SystemInfoCap.exe
1096	ElysiumExeFree.exe
1096	ElysiumExeFree.exe
4732	SystemInfoCap.exe
4732	SystemInfoCap.exe
976	ElysiumExeFree.exe
976	ElysiumExeFree.exe
4768	SystemInfoCap.exe
4768	SystemInfoCap.exe
4892	ElysiumExeFree.exe
4892	ElysiumExeFree.exe
2820	SystemInfoCap.exe
2820	SystemInfoCap.exe
1140	ElysiumExeFree.exe
1140	ElysiumExeFree.exe
3924	SystemInfoCap.exe
3924	SystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe
2436	xdwdSystemInfoCap.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	SystemInfoCap.exe
Token: SeDebugPrivilege	1160	SystemInfoCap.exe
Token: SeDebugPrivilege	4288	SystemInfoCap.exe
Token: SeDebugPrivilege	3372	SystemInfoCap.exe
Token: SeDebugPrivilege	2984	SystemInfoCap.exe
Token: SeDebugPrivilege	2312	SystemInfoCap.exe
Token: SeDebugPrivilege	5320	SystemInfoCap.exe
Token: SeDebugPrivilege	264	SystemInfoCap.exe
Token: SeDebugPrivilege	4908	xdwdNetwork.exe
Token: SeDebugPrivilege	2436	xdwdSystemInfoCap.exe
Token: SeDebugPrivilege	3792	SystemInfoCap.exe
Token: SeDebugPrivilege	6000	SystemInfoCap.exe
Token: SeDebugPrivilege	792	SystemInfoCap.exe
Token: SeDebugPrivilege	2904	SystemInfoCap.exe
Token: SeDebugPrivilege	4896	SystemInfoCap.exe
Token: SeDebugPrivilege	4732	SystemInfoCap.exe
Token: SeDebugPrivilege	4768	SystemInfoCap.exe
Token: SeDebugPrivilege	2820	SystemInfoCap.exe
Token: SeDebugPrivilege	3924	SystemInfoCap.exe
Token: SeDebugPrivilege	4220	xdwdNetwork.exe
Token: SeDebugPrivilege	4392	SystemInfoCap.exe
Token: SeDebugPrivilege	5916	SystemInfoCap.exe
Token: SeDebugPrivilege	2364	SystemInfoCap.exe
Token: SeDebugPrivilege	2724	SystemInfoCap.exe
Token: SeDebugPrivilege	720	SystemInfoCap.exe
Token: SeDebugPrivilege	296	SystemInfoCap.exe
Token: SeDebugPrivilege	1848	SystemInfoCap.exe
Token: SeDebugPrivilege	5352	SystemInfoCap.exe
Token: SeDebugPrivilege	3808	SystemInfoCap.exe
Token: SeDebugPrivilege	5528	SystemInfoCap.exe
Token: SeDebugPrivilege	4648	SystemInfoCap.exe
Token: SeDebugPrivilege	4212	SystemInfoCap.exe
Token: SeDebugPrivilege	1396	SystemInfoCap.exe
Token: SeDebugPrivilege	5864	SystemInfoCap.exe
Token: SeDebugPrivilege	4544	SystemInfoCap.exe
Token: SeDebugPrivilege	1756	SystemInfoCap.exe
Token: SeDebugPrivilege	4600	SystemInfoCap.exe
Token: SeDebugPrivilege	1172	SystemInfoCap.exe
Token: SeDebugPrivilege	1416	SystemInfoCap.exe
Token: SeDebugPrivilege	4132	SystemInfoCap.exe
Token: SeDebugPrivilege	3156	SystemInfoCap.exe
Token: SeDebugPrivilege	5360	SystemInfoCap.exe
Token: SeDebugPrivilege	5144	SystemInfoCap.exe
Token: SeDebugPrivilege	3116	SystemInfoCap.exe
Token: SeDebugPrivilege	5444	SystemInfoCap.exe
Token: SeDebugPrivilege	4636	SystemInfoCap.exe
Token: SeDebugPrivilege	4804	SystemInfoCap.exe
Token: SeDebugPrivilege	6108	SystemInfoCap.exe
Token: SeDebugPrivilege	2548	SystemInfoCap.exe
Token: SeDebugPrivilege	3856	SystemInfoCap.exe
Token: SeDebugPrivilege	1852	SystemInfoCap.exe
Token: SeDebugPrivilege	3196	SystemInfoCap.exe
Token: SeDebugPrivilege	5140	SystemInfoCap.exe
Token: SeDebugPrivilege	5656	SystemInfoCap.exe
Token: SeDebugPrivilege	1828	SystemInfoCap.exe
Token: SeDebugPrivilege	5616	SystemInfoCap.exe
Token: SeDebugPrivilege	3152	SystemInfoCap.exe
Token: SeDebugPrivilege	4820	SystemInfoCap.exe
Token: SeDebugPrivilege	248	SystemInfoCap.exe
Token: SeDebugPrivilege	5492	SystemInfoCap.exe
Token: SeDebugPrivilege	1068	SystemInfoCap.exe
Token: SeDebugPrivilege	3052	SystemInfoCap.exe
Token: SeDebugPrivilege	2540	SystemInfoCap.exe
Token: SeDebugPrivilege	5668	SystemInfoCap.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1468	1544	ElysiumExeFree.exe	89
PID 1544 wrote to memory of 560	1544	ElysiumExeFree.exe	90
PID 1468 wrote to memory of 2356	1468	ElysiumExeFree.exe	91
PID 1468 wrote to memory of 1160	1468	ElysiumExeFree.exe	92
PID 2356 wrote to memory of 5488	2356	ElysiumExeFree.exe	93
PID 2356 wrote to memory of 4288	2356	ElysiumExeFree.exe	94
PID 5488 wrote to memory of 4616	5488	ElysiumExeFree.exe	95
PID 5488 wrote to memory of 3372	5488	ElysiumExeFree.exe	96
PID 4616 wrote to memory of 1204	4616	ElysiumExeFree.exe	97
PID 4616 wrote to memory of 2984	4616	ElysiumExeFree.exe	98
PID 1204 wrote to memory of 2496	1204	ElysiumExeFree.exe	99
PID 1204 wrote to memory of 2312	1204	ElysiumExeFree.exe	100
PID 2496 wrote to memory of 3108	2496	ElysiumExeFree.exe	101
PID 2496 wrote to memory of 5320	2496	ElysiumExeFree.exe	102
PID 3108 wrote to memory of 244	3108	ElysiumExeFree.exe	103
PID 3108 wrote to memory of 264	3108	ElysiumExeFree.exe	104
PID 560 wrote to memory of 676	560	SystemInfoCap.exe	105
PID 676 wrote to memory of 1216	676	CMD.exe	107
PID 560 wrote to memory of 1500	560	SystemInfoCap.exe	108
PID 1500 wrote to memory of 2464	1500	CMD.exe	110
PID 560 wrote to memory of 4564	560	SystemInfoCap.exe	112
PID 4564 wrote to memory of 1144	4564	CMD.exe	115
PID 1160 wrote to memory of 600	1160	SystemInfoCap.exe	116
PID 600 wrote to memory of 3152	600	CMD.exe	118
PID 244 wrote to memory of 4396	244	ElysiumExeFree.exe	121
PID 244 wrote to memory of 3792	244	ElysiumExeFree.exe	122
PID 560 wrote to memory of 2556	560	SystemInfoCap.exe	123
PID 2556 wrote to memory of 2100	2556	CMD.exe	125
PID 1160 wrote to memory of 5168	1160	SystemInfoCap.exe	126
PID 5168 wrote to memory of 3708	5168	CMD.exe	128
PID 4396 wrote to memory of 2756	4396	ElysiumExeFree.exe	129
PID 4396 wrote to memory of 6000	4396	ElysiumExeFree.exe	130
PID 4288 wrote to memory of 3728	4288	SystemInfoCap.exe	131
PID 3728 wrote to memory of 5456	3728	CMD.exe	133
PID 3372 wrote to memory of 5776	3372	SystemInfoCap.exe	134
PID 5776 wrote to memory of 2908	5776	CMD.exe	136
PID 2756 wrote to memory of 5480	2756	ElysiumExeFree.exe	137
PID 2756 wrote to memory of 792	2756	ElysiumExeFree.exe	138
PID 560 wrote to memory of 2996	560	SystemInfoCap.exe	139
PID 2996 wrote to memory of 5356	2996	CMD.exe	141
PID 4288 wrote to memory of 1180	4288	SystemInfoCap.exe	142
PID 1180 wrote to memory of 4552	1180	CMD.exe	144
PID 3372 wrote to memory of 4996	3372	SystemInfoCap.exe	145
PID 4996 wrote to memory of 4592	4996	CMD.exe	147
PID 5480 wrote to memory of 5024	5480	ElysiumExeFree.exe	148
PID 5480 wrote to memory of 2904	5480	ElysiumExeFree.exe	149
PID 2984 wrote to memory of 3884	2984	SystemInfoCap.exe	150
PID 3884 wrote to memory of 5932	3884	CMD.exe	152
PID 560 wrote to memory of 672	560	SystemInfoCap.exe	153
PID 672 wrote to memory of 6136	672	CMD.exe	155
PID 5024 wrote to memory of 1388	5024	ElysiumExeFree.exe	156
PID 5024 wrote to memory of 4896	5024	ElysiumExeFree.exe	157
PID 2984 wrote to memory of 1944	2984	SystemInfoCap.exe	159
PID 1944 wrote to memory of 3208	1944	CMD.exe	161
PID 5320 wrote to memory of 4532	5320	SystemInfoCap.exe	162
PID 2312 wrote to memory of 2680	2312	SystemInfoCap.exe	164
PID 4532 wrote to memory of 1352	4532	CMD.exe	166
PID 2680 wrote to memory of 2732	2680	CMD.exe	167
PID 1388 wrote to memory of 1096	1388	ElysiumExeFree.exe	168
PID 560 wrote to memory of 4524	560	SystemInfoCap.exe	169
PID 1388 wrote to memory of 4732	1388	ElysiumExeFree.exe	170
PID 4524 wrote to memory of 6108	4524	CMD.exe	172
PID 4908 wrote to memory of 5704	4908	xdwdNetwork.exe	173
PID 5704 wrote to memory of 2932	5704	CMD.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
"C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
  "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
    "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
      "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        10⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        11⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        12⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        13⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        14⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        15⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        16⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        17⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        18⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        19⤵
        Loads dropped DLL
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        20⤵
        Loads dropped DLL
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        21⤵
        Loads dropped DLL
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        22⤵
        Loads dropped DLL
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        23⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        24⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        25⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        26⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        27⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        28⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        29⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        30⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        31⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        32⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        33⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        34⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        35⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        36⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        37⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        38⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        39⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        40⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        41⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        42⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        43⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        44⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        45⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        46⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        47⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        48⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        49⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        50⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        51⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        52⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        53⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        54⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        55⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        56⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        57⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        58⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        59⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        60⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        61⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        62⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        63⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        64⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        65⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        66⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        67⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        68⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ElysiumExeFree.exe"
        69⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        69⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        68⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        67⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        66⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        65⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        64⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        63⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        62⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5668
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        63⤵
        
        PID:2972
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        64⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        61⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        62⤵
        
        PID:5228
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        63⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2444
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        62⤵
        
        PID:5460
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        63⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        60⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        61⤵
        
        PID:3144
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        62⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5328
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        61⤵
        
        PID:3664
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        62⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        59⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        60⤵
        
        PID:4120
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        61⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6016
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        60⤵
        
        PID:124
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        61⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        58⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5492
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        59⤵
        
        PID:360
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        60⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5572
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        59⤵
        
        PID:4964
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        60⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:248
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        58⤵
        
        PID:4572
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        59⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1100
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        58⤵
        
        PID:5840
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        59⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        56⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        57⤵
        
        PID:5768
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        58⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4788
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        57⤵
        
        PID:4880
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        58⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        55⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3152
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        56⤵
        
        PID:1804
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        57⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3252
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        56⤵
        
        PID:5128
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        57⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        54⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5616
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        55⤵
        
        PID:4420
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        56⤵
        
        PID:5636
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        55⤵
        
        PID:708
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        56⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        54⤵
        
        PID:2452
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        55⤵
        
        PID:1444
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        54⤵
        
        PID:480
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        55⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        52⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5656
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        53⤵
        
        PID:1208
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        54⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1152
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        53⤵
        
        PID:5844
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        54⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5140
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        52⤵
        
        PID:4384
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        53⤵
        
        PID:1796
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        52⤵
        
        PID:4980
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        53⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        51⤵
        
        PID:4508
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        52⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5028
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        51⤵
        
        PID:1824
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        52⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        49⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        50⤵
        
        PID:2220
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        51⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:368
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        50⤵
        
        PID:5956
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        51⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        48⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3856
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        49⤵
        
        PID:1304
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        50⤵
        
        PID:5232
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        49⤵
        
        PID:568
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        50⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        47⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        48⤵
        
        PID:3388
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        49⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3972
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        48⤵
        
        PID:5312
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        49⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        46⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:6108
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        47⤵
        
        PID:5832
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        48⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4736
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        47⤵
        
        PID:1144
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        48⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        45⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        46⤵
        
        PID:4952
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        47⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2940
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        46⤵
        
        PID:1236
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        47⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        44⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        45⤵
        
        PID:5008
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        46⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2508
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        45⤵
        
        PID:5624
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        46⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5444
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        44⤵
        
        PID:5336
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        45⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5240
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        44⤵
        
        PID:4972
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        45⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        42⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        43⤵
        
        PID:2492
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        44⤵
        
        PID:2332
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        43⤵
        
        PID:5256
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        44⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5144
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        42⤵
        
        PID:1508
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        43⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2164
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        42⤵
        
        PID:2632
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        43⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5360
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        41⤵
        
        PID:6088
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        42⤵
        
        PID:3024
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        41⤵
        
        PID:3628
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        42⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        40⤵
        
        PID:3384
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        41⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4160
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        40⤵
        
        PID:5884
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        41⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        38⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        39⤵
        
        PID:1548
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        40⤵
        
        PID:2676
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        39⤵
        
        PID:1328
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        40⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        38⤵
        
        PID:5812
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        39⤵
        
        PID:2836
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        38⤵
        
        PID:1400
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        39⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        36⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        37⤵
        
        PID:900
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        38⤵
        
        PID:4972
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        37⤵
        
        PID:2672
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        38⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        36⤵
        
        PID:2876
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        37⤵
        
        PID:3056
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        36⤵
        
        PID:3436
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        37⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        34⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        35⤵
        
        PID:1384
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        36⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4280
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        35⤵
        
        PID:256
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        36⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        33⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        34⤵
        
        PID:5172
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        35⤵
        
        PID:4484
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        34⤵
        
        PID:3860
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        35⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5864
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        33⤵
        
        PID:4640
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        34⤵
        
        PID:980
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        33⤵
        
        PID:3708
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        34⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        32⤵
        
        PID:1640
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        33⤵
        
        PID:5240
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        32⤵
        
        PID:1752
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        33⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        30⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4212
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        31⤵
        
        PID:6060
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3208
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        31⤵
        
        PID:4968
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        29⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4648
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        30⤵
        
        PID:5584
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        31⤵
        
        PID:920
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        30⤵
        
        PID:620
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        31⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        28⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5528
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        29⤵
        
        PID:3916
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        30⤵
        
        PID:5200
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        29⤵
        
        PID:5092
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        30⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        27⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        28⤵
        
        PID:4860
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        29⤵
        
        PID:4968
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        28⤵
        
        PID:1120
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        29⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        26⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5352
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        27⤵
        
        PID:2912
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        28⤵
        
        PID:256
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        27⤵
        
        PID:5680
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        28⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        26⤵
        
        PID:4744
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        27⤵
        
        PID:2316
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        26⤵
        
        PID:1632
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        27⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        24⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:296
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        25⤵
        
        PID:4224
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2536
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        25⤵
        
        PID:3688
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        26⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        23⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:720
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        24⤵
        
        PID:2788
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        25⤵
        
        PID:2352
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        24⤵
        
        PID:5116
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        22⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        23⤵
        
        PID:1600
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2296
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        23⤵
        
        PID:5100
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        24⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        22⤵
        
        PID:3424
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        23⤵
        
        PID:2448
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        22⤵
        
        PID:628
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        23⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5916
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        21⤵
        
        PID:6132
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        22⤵
        
        PID:6140
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        21⤵
        
        PID:5588
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        22⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4392
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        20⤵
        
        PID:1564
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3032
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        20⤵
        
        PID:4836
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        19⤵
        
        PID:4960
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        20⤵
        
        PID:4420
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        19⤵
        
        PID:796
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        20⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        18⤵
        
        PID:2004
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        19⤵
        
        PID:5728
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        18⤵
        
        PID:2292
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        19⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        17⤵
        
        PID:2056
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        18⤵
        
        PID:3164
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        17⤵
        
        PID:1188
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        18⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        16⤵
        
        PID:5696
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5544
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        16⤵
        
        PID:2960
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        17⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        15⤵
        
        PID:2500
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        16⤵
        
        PID:4160
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        15⤵
        
        PID:5804
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        14⤵
        
        PID:3904
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        15⤵
        
        PID:3252
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        14⤵
        
        PID:1472
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        15⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        13⤵
        
        PID:2012
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        14⤵
        
        PID:5596
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        13⤵
        
        PID:3068
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        14⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6000
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        12⤵
        
        PID:2080
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        13⤵
        
        PID:4756
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        12⤵
        
        PID:5972
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        11⤵
        
        PID:4796
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        12⤵
        
        PID:3940
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        11⤵
        
        PID:3420
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:264
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        10⤵
        
        PID:1192
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        11⤵
        
        PID:5800
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        10⤵
        
        PID:4188
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        11⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5320
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        10⤵
        
        PID:1352
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        9⤵
        
        PID:4556
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        10⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2732
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        8⤵
        
        PID:908
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        9⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5932
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3372
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        7⤵
        
        PID:2908
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
      "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4288
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3728
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        6⤵
        
        PID:5456
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1180
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        6⤵
        
        PID:4552
- - C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
    "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:600
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        5⤵
        
        PID:3152
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5168
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3708
- C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Kaspersky AniMalware" /tr "C:\Windows\xdwdNetwork.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Kaspersky AniMalware" /tr "C:\Windows\xdwdNetwork.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1216
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2464
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft (R) Driver" /tr "C:\Windows\xdwdSystemInfoCap.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft (R) Driver" /tr "C:\Windows\xdwdSystemInfoCap.exe" /RL HIGHEST
      4⤵
      PID:1144
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2100
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5356
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:672
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6136
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:6108
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:3616
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2068
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:6084
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:1132
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:1684
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:5792
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5456
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:4272
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:1148
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:1312
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:5588
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:3184
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2140
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:4604
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:1828
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2660
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4928
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:1316
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:3920
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:504
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:4244
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:880
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1584
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:3824
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:1752
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:3724
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6136
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2828
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:4572
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:3308
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:1492
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:5596
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4916
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:5944
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5032
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2732
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:1220
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5824
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:4516
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:1216
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:4444
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:2448
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2308
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4284
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2068
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:5888
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:200
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:5844
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:4284
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3320
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2228
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2584
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2532
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:4812
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:5580
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:3976
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:4984
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5324
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:1044
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5572
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:4596
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3496
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:6080
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:3112
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2592
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:5200
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2824
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:2396
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:5464
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:3980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:5572
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:828

C:\Windows\xdwdNetwork.exe
C:\Windows\xdwdNetwork.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
    3⤵
    PID:2932
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
  2⤵
  PID:5356
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2576

C:\Windows\xdwdSystemInfoCap.exe
C:\Windows\xdwdSystemInfoCap.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
  2⤵
  PID:1620
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5428
- C:\Windows\xdwdNetwork.exe
  "C:\Windows\xdwdNetwork.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:1900
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:4804
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST & exit
    3⤵
    PID:2644
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Realtek HD Audio" /tr "C:\Windows\xdwdNetwork.exe" /RL HIGHEST
      4⤵
      PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemInfoCap.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemInfoCap.exe
Size 585KB
SHA256 aee62e2f65fddebc77edad3431d5afd7a3739524cbe005988f960273d61ef71c
MD5 88150142a8c50e22f7b8fafcec64c2b4
SHA1 f1c3a299e70d7cc8fb308e70d27dea7e4615c8c3
SHA512 7fec9e7220a88525dd6dd2b0896fb8d7d3b13c4858f28b8218e83b477929bb615983e2970c658ac6d46c80d124ae522c73f9c74529e937c7a9c8d9892c3bd711
SSDEEP 12288:SIBdnu6+V8PVle8YKgEXflIwNzDqAUWv59a:S2u9KgE26KH
TLSH
T1E2D4C40CFE91F805DE2E3CB7CFEA11004B7165C1AE1195562149AFFE8B663B259E227C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-16-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/560-14-0x0000000000CD0000-0x0000000000D68000-memory.dmp

Download

memory/560-23-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1468-13-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1468-17-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1468-19-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1544-3-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1544-4-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1544-2-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1544-15-0x00007FF922ED0000-0x00007FF923874000-memory.dmp

Download

memory/1544-0-0x00007FF92305F000-0x00007FF923060000-memory.dmp

Download

memory/1544-1-0x0000000000E50000-0x0000000000EEC000-memory.dmp

Download