Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe
-
Size
946KB
-
MD5
aa458100cfa6220e85e05293066d67cd
-
SHA1
34371dab7a694c8510a2c4cfb608c15de08306d5
-
SHA256
060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c
-
SHA512
8f8f801f81c346d2f9cc400d3f0abd29ad3caa82a2f430cd6c9bf07996e0787237f919ea4e5d18cc61c62235f0e3fc6a320dd73a87ef69c0837ba856a1b3ff38
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1720 5064 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 760 schtasks.exe 380 schtasks.exe 4228 schtasks.exe 1904 schtasks.exe 1484 schtasks.exe 4192 schtasks.exe 1416 schtasks.exe 4068 schtasks.exe 2368 schtasks.exe 4236 schtasks.exe 4012 schtasks.exe 1468 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 3668 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 82 PID 5064 wrote to memory of 3668 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 82 PID 5064 wrote to memory of 3668 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 82 PID 5064 wrote to memory of 3052 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 83 PID 5064 wrote to memory of 3052 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 83 PID 5064 wrote to memory of 3052 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 83 PID 5064 wrote to memory of 4592 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 84 PID 5064 wrote to memory of 4592 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 84 PID 5064 wrote to memory of 4592 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 84 PID 5064 wrote to memory of 1224 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 85 PID 5064 wrote to memory of 1224 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 85 PID 5064 wrote to memory of 1224 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 85 PID 5064 wrote to memory of 1664 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 86 PID 5064 wrote to memory of 1664 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 86 PID 5064 wrote to memory of 1664 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 86 PID 5064 wrote to memory of 1412 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 87 PID 5064 wrote to memory of 1412 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 87 PID 5064 wrote to memory of 1412 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 87 PID 5064 wrote to memory of 4196 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 88 PID 5064 wrote to memory of 4196 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 88 PID 5064 wrote to memory of 4196 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 88 PID 5064 wrote to memory of 4124 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 105 PID 5064 wrote to memory of 4124 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 105 PID 5064 wrote to memory of 4124 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 105 PID 5064 wrote to memory of 1576 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 93 PID 5064 wrote to memory of 1576 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 93 PID 5064 wrote to memory of 1576 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 93 PID 5064 wrote to memory of 212 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 95 PID 5064 wrote to memory of 212 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 95 PID 5064 wrote to memory of 212 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 95 PID 5064 wrote to memory of 1536 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 96 PID 5064 wrote to memory of 1536 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 96 PID 5064 wrote to memory of 1536 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 96 PID 5064 wrote to memory of 4604 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 98 PID 5064 wrote to memory of 4604 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 98 PID 5064 wrote to memory of 4604 5064 060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe 98 PID 4604 wrote to memory of 4236 4604 cmd.exe 116 PID 4604 wrote to memory of 4236 4604 cmd.exe 116 PID 4604 wrote to memory of 4236 4604 cmd.exe 116 PID 4196 wrote to memory of 1416 4196 cmd.exe 106 PID 4196 wrote to memory of 1416 4196 cmd.exe 106 PID 4196 wrote to memory of 1416 4196 cmd.exe 106 PID 4592 wrote to memory of 2368 4592 cmd.exe 115 PID 4592 wrote to memory of 2368 4592 cmd.exe 115 PID 4592 wrote to memory of 2368 4592 cmd.exe 115 PID 212 wrote to memory of 1904 212 cmd.exe 112 PID 212 wrote to memory of 1904 212 cmd.exe 112 PID 212 wrote to memory of 1904 212 cmd.exe 112 PID 1664 wrote to memory of 4228 1664 cmd.exe 111 PID 1664 wrote to memory of 4228 1664 cmd.exe 111 PID 1664 wrote to memory of 4228 1664 cmd.exe 111 PID 3052 wrote to memory of 380 3052 cmd.exe 110 PID 3052 wrote to memory of 380 3052 cmd.exe 110 PID 3052 wrote to memory of 380 3052 cmd.exe 110 PID 1224 wrote to memory of 1468 1224 cmd.exe 117 PID 1224 wrote to memory of 1468 1224 cmd.exe 117 PID 1224 wrote to memory of 1468 1224 cmd.exe 117 PID 1576 wrote to memory of 4192 1576 cmd.exe 114 PID 1576 wrote to memory of 4192 1576 cmd.exe 114 PID 1576 wrote to memory of 4192 1576 cmd.exe 114 PID 1536 wrote to memory of 4068 1536 cmd.exe 107 PID 1536 wrote to memory of 4068 1536 cmd.exe 107 PID 1536 wrote to memory of 4068 1536 cmd.exe 107 PID 1412 wrote to memory of 1484 1412 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵PID:3668
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:760
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:380
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:2368
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:1468
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:4228
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:1484
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5913" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5913" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:4192
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk436" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk436" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:1904
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8574" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8574" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:4068
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8448" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8448" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:4236
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"2⤵PID:4124
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\060c50b4ef3e0f9e9d07f9294d3fb248682f9bc1ba060b2f05630c2086ce7a6c.exe"3⤵
- Creates scheduled task(s)
PID:4012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 13722⤵
- Program crash
PID:1720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5064 -ip 50641⤵PID:4848