xbinder | 26e7bfe3fd0c42e5d887da4eabc6d85e06672a3a0e4be576f0f34d5ae1e759e6

Analysis

max time kernel
146s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LockerBuilder.exe
Size 242KB
Sample260730-tyhfcasbne
SHA256 26e7bfe3fd0c42e5d887da4eabc6d85e06672a3a0e4be576f0f34d5ae1e759e6
MD5 7aa53d8b1768fbe6f40e6be5f61de876
SHA1 0f8bdd55afd7773540914382111b5728df838d2b
SHA512 9e617bbda12228b7aaf38d443db4ae1f1bad6a330808bb5b084b6511ecf1e9163ad8e3afe16c3ed9810ec1f67de4e1537b33fdff40b853d390479bba43a80cbf
SSDEEP 6144:0UGnD8yvOVlWNYw3jJTLnHNIvm2qS0cgyuQM9:cnD8yvOVl43RL2u2qS0ty
TLSH
T18B3423185B708210C6FA0AB32F837142A7BBDB406FAFE7FD21F4B5269CA61D4054166F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xbinder loader persistence privilege_escalation

Malware Config

Extracted

Family

xbinder

Mutex

6Z8JLKHHGreWP6aLF

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
LockerBuilder.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
WinlockBuilder.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Public\\Documents\\xdwdCorel VideoStudio Upgrade.exe"	WinlockBuilder.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
1676	powershell.exe
1324	powershell.exe
5612	powershell.exe
3408	powershell.exe
3324	powershell.exe
3736	powershell.exe
4560	powershell.exe
2756	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 11 IoCs

pid	Process
5828	WinlockBuilder.exe
3848	WinlockBuilder.exe
2116	WinlockBuilder.exe
5032	WinlockBuilder.exe
2008	WinlockBuilder.exe
4404	WinlockBuilder.exe
5616	WinlockBuilder.exe
3296	WinlockBuilder.exe
3432	xdwdMicrosoft Security Essentials.exe
2436	WinlockBuilder.exe
1680	xdwdCorel VideoStudio Upgrade.exe

Loads dropped DLL 64 IoCs

pid	Process
2840	Process not Found
4288	Process not Found
968	LockerBuilder.exe
4664	Process not Found
4796	Process not Found
3004	Process not Found
3736	powershell.exe
3432	xdwdMicrosoft Security Essentials.exe
5564	Process not Found
976	Process not Found
2436	WinlockBuilder.exe
4660	Process not Found
4860	Process not Found
5468	Process not Found
3820	Process not Found
4168	Process not Found
2368	Process not Found
2092	Process not Found
5984	WmiApSrv.exe
5960	Process not Found
1676	Process not Found
1680	Process not Found
4800	Process not Found
3380	Conhost.exe
1380	Process not Found
5448	Process not Found
4908	Process not Found
4204	Process not Found
5248	Process not Found
1116	Process not Found
3288	Process not Found
2604	Process not Found
4876	Process not Found
5076	Process not Found
1396	Process not Found
3820	Process not Found
2720	Process not Found
3164	Process not Found
1184	Process not Found
248	Process not Found
1680	xdwdCorel VideoStudio Upgrade.exe
2568	Process not Found
5400	Process not Found
4760	Process not Found
4092	Process not Found
4448	Conhost.exe
2708	Process not Found
5964	Process not Found
1824	Process not Found
5336	Process not Found
5176	Conhost.exe
4196	Process not Found
5428	Process not Found
4736	Process not Found
4380	Process not Found
1300	Process not Found
1184	Process not Found
3496	Process not Found
6048	Process not Found
1324	Process not Found
2884	Process not Found
2568	Process not Found
4260	Process not Found
4560	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Userinit = "C:\\Windows\\System32\\xdwdMicrosoft Security Essentials.exe"	WinlockBuilder.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
3	ipinfo.io
3	icanhazip.com
11	icanhazip.com
13	api.ipify.org

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	xdwdMicrosoft Security Essentials.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	xdwdCorel VideoStudio Upgrade.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe
File opened for modification	C:\Windows\System32\xdwdMicrosoft Security Essentials.exe	WinlockBuilder.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	xdwdMicrosoft Security Essentials.exe
File opened for modification	C:\Windows\System32	xdwdCorel VideoStudio Upgrade.exe
File created	C:\Windows\xdwd.dll	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe
File opened for modification	C:\Windows\System32	WinlockBuilder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 63 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1808	CMD.exe
3144	CMD.exe
4892	CMD.exe
4632	CMD.exe
3332	CMD.exe
5152	CMD.exe
3132	CMD.exe
1468	CMD.exe
4352	CMD.exe
2732	CMD.exe
4888	CMD.exe
2580	CMD.exe
6028	CMD.exe
2528	CMD.exe
3184	CMD.exe
3252	CMD.exe
5528	CMD.exe
5776	CMD.exe
1092	CMD.exe
3312	CMD.exe
200	CMD.exe
3292	CMD.exe
3472	CMD.exe
4596	CMD.exe
4108	CMD.exe
2148	CMD.exe
1180	CMD.exe
352	CMD.exe
2840	CMD.exe
4472	CMD.exe
2616	CMD.exe
3352	CMD.exe
3900	CMD.exe
1820	CMD.exe
2800	CMD.exe
4668	CMD.exe
5040	CMD.exe
3240	CMD.exe
5924	CMD.exe
5376	CMD.exe
1296	CMD.exe
5888	CMD.exe
2076	CMD.exe
3360	CMD.exe
4140	CMD.exe
2476	CMD.exe
3408	CMD.exe
4884	CMD.exe
5204	CMD.exe
4112	CMD.exe
4480	CMD.exe
4992	CMD.exe
2252	CMD.exe
1368	CMD.exe
5412	CMD.exe
5148	CMD.exe
3204	CMD.exe
5220	CMD.exe
4640	CMD.exe
3984	CMD.exe
5772	CMD.exe
5260	CMD.exe
4320	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 63 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4448	schtasks.exe
2880	schtasks.exe
3792	schtasks.exe
2512	schtasks.exe
4844	schtasks.exe
4516	schtasks.exe
1532	schtasks.exe
4816	schtasks.exe
2992	schtasks.exe
1240	schtasks.exe
5548	schtasks.exe
5992	schtasks.exe
3380	schtasks.exe
3604	schtasks.exe
4876	schtasks.exe
5076	schtasks.exe
6016	schtasks.exe
2016	schtasks.exe
5772	schtasks.exe
4632	schtasks.exe
792	schtasks.exe
6040	schtasks.exe
4476	schtasks.exe
5756	schtasks.exe
5136	schtasks.exe
6104	schtasks.exe
2744	schtasks.exe
908	schtasks.exe
2076	schtasks.exe
5352	schtasks.exe
1228	schtasks.exe
4252	schtasks.exe
5380	schtasks.exe
1680	schtasks.exe
2484	schtasks.exe
5352	schtasks.exe
5176	schtasks.exe
3456	schtasks.exe
5248	schtasks.exe
2880	schtasks.exe
4852	schtasks.exe
5492	schtasks.exe
5360	schtasks.exe
2120	schtasks.exe
612	schtasks.exe
4732	schtasks.exe
3900	schtasks.exe
5480	schtasks.exe
984	schtasks.exe
2140	schtasks.exe
2804	schtasks.exe
2824	schtasks.exe
4648	schtasks.exe
3900	schtasks.exe
936	schtasks.exe
1092	schtasks.exe
3876	schtasks.exe
4996	schtasks.exe
4352	schtasks.exe
5656	schtasks.exe
1284	schtasks.exe
4764	schtasks.exe
4660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4872	powershell.exe
4872	powershell.exe
1676	powershell.exe
1676	powershell.exe
1324	powershell.exe
1324	powershell.exe
1324	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
5612	powershell.exe
5612	powershell.exe
5612	powershell.exe
3408	powershell.exe
3408	powershell.exe
3408	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
968	LockerBuilder.exe
968	LockerBuilder.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
2436	WinlockBuilder.exe
2436	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
3848	WinlockBuilder.exe
3848	WinlockBuilder.exe
5828	WinlockBuilder.exe
5828	WinlockBuilder.exe
3848	WinlockBuilder.exe
3848	WinlockBuilder.exe
2116	WinlockBuilder.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeIncreaseQuotaPrivilege	4872	powershell.exe
Token: SeSecurityPrivilege	4872	powershell.exe
Token: SeTakeOwnershipPrivilege	4872	powershell.exe
Token: SeLoadDriverPrivilege	4872	powershell.exe
Token: SeSystemProfilePrivilege	4872	powershell.exe
Token: SeSystemtimePrivilege	4872	powershell.exe
Token: SeProfSingleProcessPrivilege	4872	powershell.exe
Token: SeIncBasePriorityPrivilege	4872	powershell.exe
Token: SeCreatePagefilePrivilege	4872	powershell.exe
Token: SeBackupPrivilege	4872	powershell.exe
Token: SeRestorePrivilege	4872	powershell.exe
Token: SeShutdownPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeSystemEnvironmentPrivilege	4872	powershell.exe
Token: SeRemoteShutdownPrivilege	4872	powershell.exe
Token: SeUndockPrivilege	4872	powershell.exe
Token: SeManageVolumePrivilege	4872	powershell.exe
Token: 33	4872	powershell.exe
Token: 34	4872	powershell.exe
Token: 35	4872	powershell.exe
Token: 36	4872	powershell.exe
Token: SeDebugPrivilege	5828	WinlockBuilder.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe
Token: 34	1676	powershell.exe
Token: 35	1676	powershell.exe
Token: 36	1676	powershell.exe
Token: SeDebugPrivilege	3848	WinlockBuilder.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeIncreaseQuotaPrivilege	1324	powershell.exe
Token: SeSecurityPrivilege	1324	powershell.exe
Token: SeTakeOwnershipPrivilege	1324	powershell.exe
Token: SeLoadDriverPrivilege	1324	powershell.exe
Token: SeSystemProfilePrivilege	1324	powershell.exe
Token: SeSystemtimePrivilege	1324	powershell.exe
Token: SeProfSingleProcessPrivilege	1324	powershell.exe
Token: SeIncBasePriorityPrivilege	1324	powershell.exe
Token: SeCreatePagefilePrivilege	1324	powershell.exe
Token: SeBackupPrivilege	1324	powershell.exe
Token: SeRestorePrivilege	1324	powershell.exe
Token: SeShutdownPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeSystemEnvironmentPrivilege	1324	powershell.exe
Token: SeRemoteShutdownPrivilege	1324	powershell.exe
Token: SeUndockPrivilege	1324	powershell.exe
Token: SeManageVolumePrivilege	1324	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3712	3480	LockerBuilder.exe	89
PID 3480 wrote to memory of 4872	3480	LockerBuilder.exe	90
PID 3480 wrote to memory of 5828	3480	LockerBuilder.exe	93
PID 3712 wrote to memory of 3156	3712	LockerBuilder.exe	95
PID 3712 wrote to memory of 1676	3712	LockerBuilder.exe	96
PID 3712 wrote to memory of 3848	3712	LockerBuilder.exe	98
PID 3156 wrote to memory of 2036	3156	LockerBuilder.exe	99
PID 3156 wrote to memory of 1324	3156	LockerBuilder.exe	100
PID 3156 wrote to memory of 2116	3156	LockerBuilder.exe	102
PID 2036 wrote to memory of 2964	2036	LockerBuilder.exe	103
PID 2036 wrote to memory of 4560	2036	LockerBuilder.exe	104
PID 2036 wrote to memory of 5032	2036	LockerBuilder.exe	106
PID 2964 wrote to memory of 3668	2964	LockerBuilder.exe	107
PID 2964 wrote to memory of 5612	2964	LockerBuilder.exe	108
PID 2964 wrote to memory of 2008	2964	LockerBuilder.exe	110
PID 3668 wrote to memory of 3080	3668	LockerBuilder.exe	111
PID 3668 wrote to memory of 3408	3668	LockerBuilder.exe	112
PID 3668 wrote to memory of 4404	3668	LockerBuilder.exe	114
PID 3080 wrote to memory of 4924	3080	LockerBuilder.exe	115
PID 3080 wrote to memory of 2756	3080	LockerBuilder.exe	116
PID 3080 wrote to memory of 5616	3080	LockerBuilder.exe	118
PID 4924 wrote to memory of 1584	4924	LockerBuilder.exe	119
PID 4924 wrote to memory of 3324	4924	LockerBuilder.exe	120
PID 5828 wrote to memory of 5152	5828	WinlockBuilder.exe	122
PID 5152 wrote to memory of 3900	5152	CMD.exe	224
PID 4924 wrote to memory of 3296	4924	LockerBuilder.exe	125
PID 5828 wrote to memory of 1180	5828	WinlockBuilder.exe	126
PID 1180 wrote to memory of 5380	1180	CMD.exe	129
PID 5828 wrote to memory of 4888	5828	WinlockBuilder.exe	130
PID 4888 wrote to memory of 1680	4888	CMD.exe	228
PID 5828 wrote to memory of 4472	5828	WinlockBuilder.exe	133
PID 4472 wrote to memory of 3380	4472	CMD.exe	179
PID 1584 wrote to memory of 968	1584	LockerBuilder.exe	136
PID 1584 wrote to memory of 3736	1584	LockerBuilder.exe	137
PID 1584 wrote to memory of 2436	1584	LockerBuilder.exe	144
PID 5828 wrote to memory of 3292	5828	WinlockBuilder.exe	145
PID 3292 wrote to memory of 5352	3292	CMD.exe	203
PID 3848 wrote to memory of 3252	3848	WinlockBuilder.exe	148
PID 3252 wrote to memory of 4632	3252	CMD.exe	254
PID 3848 wrote to memory of 2616	3848	WinlockBuilder.exe	151
PID 2616 wrote to memory of 4352	2616	CMD.exe	209
PID 2116 wrote to memory of 4668	2116	WinlockBuilder.exe	154
PID 4668 wrote to memory of 2880	4668	CMD.exe	212
PID 2116 wrote to memory of 3360	2116	WinlockBuilder.exe	157
PID 3360 wrote to memory of 984	3360	CMD.exe	159
PID 5828 wrote to memory of 1368	5828	WinlockBuilder.exe	160
PID 2008 wrote to memory of 3472	2008	WinlockBuilder.exe	161
PID 1368 wrote to memory of 3604	1368	CMD.exe	164
PID 3472 wrote to memory of 936	3472	CMD.exe	165
PID 2008 wrote to memory of 352	2008	WinlockBuilder.exe	167
PID 352 wrote to memory of 3900	352	CMD.exe	224
PID 3848 wrote to memory of 1808	3848	WinlockBuilder.exe	171
PID 1808 wrote to memory of 4252	1808	CMD.exe	173
PID 5032 wrote to memory of 4596	5032	WinlockBuilder.exe	174
PID 4596 wrote to memory of 4476	4596	CMD.exe	176
PID 5032 wrote to memory of 5528	5032	WinlockBuilder.exe	177
PID 2116 wrote to memory of 5040	2116	WinlockBuilder.exe	178
PID 5528 wrote to memory of 5772	5528	CMD.exe	181
PID 5040 wrote to memory of 792	5040	CMD.exe	182
PID 5828 wrote to memory of 3144	5828	WinlockBuilder.exe	183
PID 3144 wrote to memory of 5756	3144	CMD.exe	185
PID 4404 wrote to memory of 5220	4404	WinlockBuilder.exe	186
PID 5220 wrote to memory of 1092	5220	CMD.exe	239
PID 4404 wrote to memory of 5776	4404	WinlockBuilder.exe	189

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
  "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
    "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
      "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LockerBuilder.exe"
        10⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2436
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        11⤵
        Executes a command shell one-liner
        
        PID:3352
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2804
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        11⤵
        Executes a command shell one-liner
        
        PID:3900
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3296
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        10⤵
        Executes a command shell one-liner
        
        PID:3132
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2076
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        10⤵
        Executes a command shell one-liner
        
        PID:1468
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5176
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        10⤵
        Executes a command shell one-liner
        
        PID:2580
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5616
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        9⤵
        Executes a command shell one-liner
        
        PID:3240
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4448
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        9⤵
        Executes a command shell one-liner
        
        PID:5412
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5220
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1092
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        8⤵
        Executes a command shell one-liner
        
        PID:5776
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1228
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        8⤵
        Executes a command shell one-liner
        
        PID:4352
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2880
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:936
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:352
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4476
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5528
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Loads dropped DLL
        
        PID:3380
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5772
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        6⤵
        Executes a command shell one-liner
        
        PID:4892
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
      "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4668
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2880
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3360
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:984
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5040
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
    "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3252
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4632
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4352
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe
  "C:\Users\Admin\AppData\Local\Temp\WinlockBuilder.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "WinlockerBuilder" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "WinlockerBuilder" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3900
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5380
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftDefender" /tr "C:\Windows\System32\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftDefender" /tr "C:\Windows\System32\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1680
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3380
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5352
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3604
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5756
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4140
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5352
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2476
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4852
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5148
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3792
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5204
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5136
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5260
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3456
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5480
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3204
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Loads dropped DLL
      PID:4448
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5248
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4480
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3876
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:6028
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Loads dropped DLL
      PID:5176
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5076
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4108
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1284
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1296
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5360
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2528
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2512
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3312
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4816
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2148
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6016
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5888
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2824
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4992
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2120
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3184
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2744
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2840
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4844
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2252
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4764
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2732
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4516
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5924
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2016
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:200
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:612
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1820
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2992
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3408
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4648
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3332
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1240
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4884
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4660
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2076
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4996
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5772
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:908
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4320
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5548
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5376
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4732
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2800
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5992

C:\Windows\System32\xdwdMicrosoft Security Essentials.exe
"C:\Windows\System32\xdwdMicrosoft Security Essentials.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:3432
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe
  "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1680
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4112
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1532
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3984
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6104
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4632
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD Update" /tr "C:\Users\Public\Documents\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4876

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact