Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe
-
Size
944KB
-
MD5
e2d222f019458794dea2d7e42890f4f1
-
SHA1
dc4a383346d9819b6c55a9cf18f326ce4269e3e5
-
SHA256
85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce
-
SHA512
8f9a950f454797a44377d0505793066cd6b5ce2d1ff723109999ae984cde93664e3e3adde420bc7c0d2f8c41707ae353f17c7c478ee393f94cc549fe41251415
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4700 660 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2624 schtasks.exe 1748 schtasks.exe 3896 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 660 wrote to memory of 1292 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 82 PID 660 wrote to memory of 1292 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 82 PID 660 wrote to memory of 1292 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 82 PID 660 wrote to memory of 1164 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 83 PID 660 wrote to memory of 1164 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 83 PID 660 wrote to memory of 1164 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 83 PID 660 wrote to memory of 3856 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 91 PID 660 wrote to memory of 3856 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 91 PID 660 wrote to memory of 3856 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 91 PID 660 wrote to memory of 4340 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 85 PID 660 wrote to memory of 4340 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 85 PID 660 wrote to memory of 4340 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 85 PID 660 wrote to memory of 4920 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 86 PID 660 wrote to memory of 4920 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 86 PID 660 wrote to memory of 4920 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 86 PID 660 wrote to memory of 4512 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 87 PID 660 wrote to memory of 4512 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 87 PID 660 wrote to memory of 4512 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 87 PID 660 wrote to memory of 4900 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 92 PID 660 wrote to memory of 4900 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 92 PID 660 wrote to memory of 4900 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 92 PID 660 wrote to memory of 4596 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 93 PID 660 wrote to memory of 4596 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 93 PID 660 wrote to memory of 4596 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 93 PID 660 wrote to memory of 2028 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 96 PID 660 wrote to memory of 2028 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 96 PID 660 wrote to memory of 2028 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 96 PID 660 wrote to memory of 1204 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 103 PID 660 wrote to memory of 1204 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 103 PID 660 wrote to memory of 1204 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 103 PID 660 wrote to memory of 5048 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 97 PID 660 wrote to memory of 5048 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 97 PID 660 wrote to memory of 5048 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 97 PID 660 wrote to memory of 2680 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 102 PID 660 wrote to memory of 2680 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 102 PID 660 wrote to memory of 2680 660 85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe 102 PID 1292 wrote to memory of 2624 1292 cmd.exe 105 PID 1292 wrote to memory of 2624 1292 cmd.exe 105 PID 1292 wrote to memory of 2624 1292 cmd.exe 105 PID 1204 wrote to memory of 3896 1204 cmd.exe 108 PID 1204 wrote to memory of 3896 1204 cmd.exe 108 PID 1204 wrote to memory of 3896 1204 cmd.exe 108 PID 4340 wrote to memory of 1748 4340 cmd.exe 107 PID 4340 wrote to memory of 1748 4340 cmd.exe 107 PID 4340 wrote to memory of 1748 4340 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"3⤵
- Creates scheduled task(s)
PID:2624
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:1164
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"3⤵
- Creates scheduled task(s)
PID:1748
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:4920
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:4512
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:3856
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:4900
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:4596
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9638" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4163" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:5048
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5663" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵PID:2680
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk345" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk345" /TR "C:\Users\Admin\AppData\Local\Temp\85717b0074e88dcc25b4db7166834c15f2d98ec27ab382094c94b1f1fdb414ce.exe"3⤵
- Creates scheduled task(s)
PID:3896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 9642⤵
- Program crash
PID:4700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 660 -ip 6601⤵PID:1188