Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe
-
Size
945KB
-
MD5
727efcd6b69f59780eba8f8d0ca087fb
-
SHA1
1c8dd65385f5f38612e47a653f5dc73ded13e220
-
SHA256
8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325
-
SHA512
8e8dcd0f14ca5b253008315bfd9b6a70f7ef9ff8e3966d34323cb3695e6768854bdaf270a0217be7ec669ada08aae6782575208686a0a113fefdea3d7a29321e
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4424 5056 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4944 schtasks.exe 4256 schtasks.exe 4724 schtasks.exe 4132 schtasks.exe 4328 schtasks.exe 996 schtasks.exe 4784 schtasks.exe 2444 schtasks.exe 4608 schtasks.exe 2036 schtasks.exe 1852 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 1040 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 84 PID 5056 wrote to memory of 1040 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 84 PID 5056 wrote to memory of 1040 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 84 PID 5056 wrote to memory of 4788 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 85 PID 5056 wrote to memory of 4788 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 85 PID 5056 wrote to memory of 4788 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 85 PID 5056 wrote to memory of 1268 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 87 PID 5056 wrote to memory of 1268 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 87 PID 5056 wrote to memory of 1268 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 87 PID 5056 wrote to memory of 4088 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 99 PID 5056 wrote to memory of 4088 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 99 PID 5056 wrote to memory of 4088 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 99 PID 5056 wrote to memory of 224 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 98 PID 5056 wrote to memory of 224 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 98 PID 5056 wrote to memory of 224 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 98 PID 5056 wrote to memory of 1544 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 91 PID 5056 wrote to memory of 1544 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 91 PID 5056 wrote to memory of 1544 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 91 PID 5056 wrote to memory of 3992 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 96 PID 5056 wrote to memory of 3992 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 96 PID 5056 wrote to memory of 3992 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 96 PID 5056 wrote to memory of 2012 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 93 PID 5056 wrote to memory of 2012 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 93 PID 5056 wrote to memory of 2012 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 93 PID 5056 wrote to memory of 4680 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 94 PID 5056 wrote to memory of 4680 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 94 PID 5056 wrote to memory of 4680 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 94 PID 5056 wrote to memory of 4708 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 100 PID 5056 wrote to memory of 4708 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 100 PID 5056 wrote to memory of 4708 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 100 PID 5056 wrote to memory of 3360 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 103 PID 5056 wrote to memory of 3360 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 103 PID 5056 wrote to memory of 3360 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 103 PID 5056 wrote to memory of 3548 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 104 PID 5056 wrote to memory of 3548 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 104 PID 5056 wrote to memory of 3548 5056 8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe 104 PID 4788 wrote to memory of 4784 4788 cmd.exe 110 PID 4788 wrote to memory of 4784 4788 cmd.exe 110 PID 4788 wrote to memory of 4784 4788 cmd.exe 110 PID 4088 wrote to memory of 4724 4088 cmd.exe 111 PID 4088 wrote to memory of 4724 4088 cmd.exe 111 PID 4088 wrote to memory of 4724 4088 cmd.exe 111 PID 1040 wrote to memory of 4256 1040 cmd.exe 109 PID 1040 wrote to memory of 4256 1040 cmd.exe 109 PID 1040 wrote to memory of 4256 1040 cmd.exe 109 PID 1268 wrote to memory of 4944 1268 cmd.exe 108 PID 1268 wrote to memory of 4944 1268 cmd.exe 108 PID 1268 wrote to memory of 4944 1268 cmd.exe 108 PID 1544 wrote to memory of 2444 1544 cmd.exe 112 PID 1544 wrote to memory of 2444 1544 cmd.exe 112 PID 1544 wrote to memory of 2444 1544 cmd.exe 112 PID 3992 wrote to memory of 4328 3992 cmd.exe 116 PID 3992 wrote to memory of 4328 3992 cmd.exe 116 PID 3992 wrote to memory of 4328 3992 cmd.exe 116 PID 224 wrote to memory of 4132 224 cmd.exe 113 PID 224 wrote to memory of 4132 224 cmd.exe 113 PID 224 wrote to memory of 4132 224 cmd.exe 113 PID 2012 wrote to memory of 2036 2012 cmd.exe 115 PID 2012 wrote to memory of 2036 2012 cmd.exe 115 PID 2012 wrote to memory of 2036 2012 cmd.exe 115 PID 3360 wrote to memory of 4608 3360 cmd.exe 114 PID 3360 wrote to memory of 4608 3360 cmd.exe 114 PID 3360 wrote to memory of 4608 3360 cmd.exe 114 PID 3548 wrote to memory of 996 3548 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:4256
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:4784
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:4944
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5529" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵PID:4680
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5529" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:1852
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:4328
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:4132
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:4724
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8457" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵PID:4708
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3960" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3960" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:4608
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5112" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5112" /TR "C:\Users\Admin\AppData\Local\Temp\8f0f0b0e655c9314425685ee89d94453602513270682184f828cc6ac997a8325.exe"3⤵
- Creates scheduled task(s)
PID:996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 14002⤵
- Program crash
PID:4424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5056 -ip 50561⤵PID:3144