Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2022, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe
-
Size
892KB
-
MD5
1cc36046d027be58174f0313dee5050d
-
SHA1
acb860fcde71bed0e286e0d168ddc0887f90e280
-
SHA256
b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948
-
SHA512
e38f2108f74735da42f436b6f16186a8dc077d2845db3fc7e24a3162af5df79ac4f9637cab09f6e50a3dc9117d8d5a455b7cc5283cbca53cd242209eb4ec9259
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 456 2804 WerFault.exe 80 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3744 schtasks.exe 1640 schtasks.exe 1372 schtasks.exe 2068 schtasks.exe 2796 schtasks.exe 2896 schtasks.exe 3844 schtasks.exe 4660 schtasks.exe 3840 schtasks.exe 4248 schtasks.exe 1112 schtasks.exe 1316 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 3852 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 82 PID 2804 wrote to memory of 3852 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 82 PID 2804 wrote to memory of 3852 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 82 PID 2804 wrote to memory of 3040 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 83 PID 2804 wrote to memory of 3040 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 83 PID 2804 wrote to memory of 3040 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 83 PID 2804 wrote to memory of 1476 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 86 PID 2804 wrote to memory of 1476 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 86 PID 2804 wrote to memory of 1476 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 86 PID 2804 wrote to memory of 5036 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 93 PID 2804 wrote to memory of 5036 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 93 PID 2804 wrote to memory of 5036 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 93 PID 2804 wrote to memory of 4612 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 88 PID 2804 wrote to memory of 4612 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 88 PID 2804 wrote to memory of 4612 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 88 PID 2804 wrote to memory of 2296 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 89 PID 2804 wrote to memory of 2296 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 89 PID 2804 wrote to memory of 2296 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 89 PID 2804 wrote to memory of 3476 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 90 PID 2804 wrote to memory of 3476 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 90 PID 2804 wrote to memory of 3476 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 90 PID 2804 wrote to memory of 4904 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 107 PID 2804 wrote to memory of 4904 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 107 PID 2804 wrote to memory of 4904 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 107 PID 2804 wrote to memory of 3100 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 95 PID 2804 wrote to memory of 3100 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 95 PID 2804 wrote to memory of 3100 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 95 PID 2804 wrote to memory of 1660 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 96 PID 2804 wrote to memory of 1660 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 96 PID 2804 wrote to memory of 1660 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 96 PID 2804 wrote to memory of 4496 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 97 PID 2804 wrote to memory of 4496 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 97 PID 2804 wrote to memory of 4496 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 97 PID 2804 wrote to memory of 2488 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 98 PID 2804 wrote to memory of 2488 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 98 PID 2804 wrote to memory of 2488 2804 b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe 98 PID 3852 wrote to memory of 1112 3852 cmd.exe 101 PID 3852 wrote to memory of 1112 3852 cmd.exe 101 PID 3852 wrote to memory of 1112 3852 cmd.exe 101 PID 4904 wrote to memory of 1316 4904 cmd.exe 103 PID 4904 wrote to memory of 1316 4904 cmd.exe 103 PID 4904 wrote to memory of 1316 4904 cmd.exe 103 PID 3100 wrote to memory of 2796 3100 cmd.exe 108 PID 3100 wrote to memory of 2796 3100 cmd.exe 108 PID 3100 wrote to memory of 2796 3100 cmd.exe 108 PID 3040 wrote to memory of 2896 3040 cmd.exe 109 PID 3040 wrote to memory of 2896 3040 cmd.exe 109 PID 3040 wrote to memory of 2896 3040 cmd.exe 109 PID 5036 wrote to memory of 1640 5036 cmd.exe 111 PID 5036 wrote to memory of 1640 5036 cmd.exe 111 PID 5036 wrote to memory of 1640 5036 cmd.exe 111 PID 1476 wrote to memory of 3744 1476 cmd.exe 110 PID 1476 wrote to memory of 3744 1476 cmd.exe 110 PID 1476 wrote to memory of 3744 1476 cmd.exe 110 PID 3476 wrote to memory of 3844 3476 cmd.exe 113 PID 3476 wrote to memory of 3844 3476 cmd.exe 113 PID 3476 wrote to memory of 3844 3476 cmd.exe 113 PID 2296 wrote to memory of 1372 2296 cmd.exe 112 PID 2296 wrote to memory of 1372 2296 cmd.exe 112 PID 2296 wrote to memory of 1372 2296 cmd.exe 112 PID 4496 wrote to memory of 4660 4496 cmd.exe 115 PID 4496 wrote to memory of 4660 4496 cmd.exe 115 PID 4496 wrote to memory of 4660 4496 cmd.exe 115 PID 1660 wrote to memory of 2068 1660 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:1112
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:3744
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵PID:4612
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:4248
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:1372
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:3844
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5722" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5722" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:2796
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6682" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6682" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:2068
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk878" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk878" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:4660
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3012" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵PID:2488
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3012" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"3⤵
- Creates scheduled task(s)
PID:3840
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 10362⤵
- Program crash
PID:456
-
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\b02fe310d014ab74b5c6bcfafe5ec949febbe2f694518082538f57b7f40c0948.exe"1⤵
- Creates scheduled task(s)
PID:1316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2804 -ip 28041⤵PID:1780