Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2022, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe
Resource
win10v2004-20220812-en
General
-
Target
3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe
-
Size
951KB
-
MD5
aeacf2b841487ac2759a2de75224f697
-
SHA1
6f77dc36130b342ebed691e2095f014ad1b953b9
-
SHA256
3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc
-
SHA512
3634d26d218f32c2c9c7c02d4fbc923067f4b604f6f67d62286b4b4f4d012d30f1c9f0d25d61866708c897f70899de9d57ec523e4985d48c6fd46fd700cf58d1
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 328 4928 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3704 schtasks.exe 3740 schtasks.exe 3116 schtasks.exe 1212 schtasks.exe 3376 schtasks.exe 2940 schtasks.exe 3108 schtasks.exe 1620 schtasks.exe 4064 schtasks.exe 1820 schtasks.exe 3940 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4220 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 83 PID 4928 wrote to memory of 4220 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 83 PID 4928 wrote to memory of 4220 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 83 PID 4928 wrote to memory of 768 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 84 PID 4928 wrote to memory of 768 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 84 PID 4928 wrote to memory of 768 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 84 PID 4928 wrote to memory of 4152 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 96 PID 4928 wrote to memory of 4152 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 96 PID 4928 wrote to memory of 4152 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 96 PID 4928 wrote to memory of 4444 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 95 PID 4928 wrote to memory of 4444 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 95 PID 4928 wrote to memory of 4444 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 95 PID 4928 wrote to memory of 1712 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 94 PID 4928 wrote to memory of 1712 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 94 PID 4928 wrote to memory of 1712 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 94 PID 4928 wrote to memory of 1096 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 93 PID 4928 wrote to memory of 1096 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 93 PID 4928 wrote to memory of 1096 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 93 PID 4928 wrote to memory of 1372 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 90 PID 4928 wrote to memory of 1372 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 90 PID 4928 wrote to memory of 1372 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 90 PID 4928 wrote to memory of 1836 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 92 PID 4928 wrote to memory of 1836 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 92 PID 4928 wrote to memory of 1836 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 92 PID 4928 wrote to memory of 3176 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 97 PID 4928 wrote to memory of 3176 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 97 PID 4928 wrote to memory of 3176 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 97 PID 4928 wrote to memory of 4512 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 105 PID 4928 wrote to memory of 4512 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 105 PID 4928 wrote to memory of 4512 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 105 PID 4928 wrote to memory of 3480 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 99 PID 4928 wrote to memory of 3480 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 99 PID 4928 wrote to memory of 3480 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 99 PID 4928 wrote to memory of 220 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 100 PID 4928 wrote to memory of 220 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 100 PID 4928 wrote to memory of 220 4928 3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe 100 PID 1836 wrote to memory of 3116 1836 cmd.exe 113 PID 1836 wrote to memory of 3116 1836 cmd.exe 113 PID 1836 wrote to memory of 3116 1836 cmd.exe 113 PID 220 wrote to memory of 3740 220 cmd.exe 112 PID 220 wrote to memory of 3740 220 cmd.exe 112 PID 220 wrote to memory of 3740 220 cmd.exe 112 PID 3176 wrote to memory of 3108 3176 cmd.exe 111 PID 3176 wrote to memory of 3108 3176 cmd.exe 111 PID 3176 wrote to memory of 3108 3176 cmd.exe 111 PID 768 wrote to memory of 3376 768 cmd.exe 107 PID 768 wrote to memory of 3376 768 cmd.exe 107 PID 768 wrote to memory of 3376 768 cmd.exe 107 PID 4444 wrote to memory of 2940 4444 cmd.exe 109 PID 4444 wrote to memory of 2940 4444 cmd.exe 109 PID 4444 wrote to memory of 2940 4444 cmd.exe 109 PID 4512 wrote to memory of 3940 4512 cmd.exe 108 PID 4512 wrote to memory of 3940 4512 cmd.exe 108 PID 4512 wrote to memory of 3940 4512 cmd.exe 108 PID 4152 wrote to memory of 3704 4152 cmd.exe 110 PID 4152 wrote to memory of 3704 4152 cmd.exe 110 PID 4152 wrote to memory of 3704 4152 cmd.exe 110 PID 4220 wrote to memory of 1212 4220 cmd.exe 114 PID 4220 wrote to memory of 1212 4220 cmd.exe 114 PID 4220 wrote to memory of 1212 4220 cmd.exe 114 PID 1712 wrote to memory of 1620 1712 cmd.exe 115 PID 1712 wrote to memory of 1620 1712 cmd.exe 115 PID 1712 wrote to memory of 1620 1712 cmd.exe 115 PID 3480 wrote to memory of 4064 3480 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:1212
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:3376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵PID:1372
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:3116
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵PID:1096
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:1620
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:2940
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:3704
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6705" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6705" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:3108
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2085" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2085" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:4064
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1180" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1180" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:3740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4414" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4414" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"3⤵
- Creates scheduled task(s)
PID:3940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 13682⤵
- Program crash
PID:328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4928 -ip 49281⤵PID:3104