Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2022, 09:04
Static task
static1
Behavioral task
behavioral1
Sample
aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe
-
Size
956KB
-
MD5
1398b06fef2f065fc38ffb6450522c4b
-
SHA1
c3aa3a83137704ba598fce010136a7fd07f84b2f
-
SHA256
aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245
-
SHA512
5ae55626535df478170ff406b1237119dbbe3859b40c922529b43ae2e5eca41232eb12358cf263f83c045926fe0add6b23d25df9e07ea8a111174cc2ad74e1aa
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3268 1448 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 208 schtasks.exe 2268 schtasks.exe 3032 schtasks.exe 216 schtasks.exe 4288 schtasks.exe 4480 schtasks.exe 308 schtasks.exe 2304 schtasks.exe 3788 schtasks.exe 320 schtasks.exe 3752 schtasks.exe 228 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2460 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 82 PID 1448 wrote to memory of 2460 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 82 PID 1448 wrote to memory of 2460 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 82 PID 1448 wrote to memory of 4844 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 92 PID 1448 wrote to memory of 4844 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 92 PID 1448 wrote to memory of 4844 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 92 PID 1448 wrote to memory of 3824 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 84 PID 1448 wrote to memory of 3824 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 84 PID 1448 wrote to memory of 3824 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 84 PID 1448 wrote to memory of 4636 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 85 PID 1448 wrote to memory of 4636 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 85 PID 1448 wrote to memory of 4636 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 85 PID 1448 wrote to memory of 5064 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 89 PID 1448 wrote to memory of 5064 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 89 PID 1448 wrote to memory of 5064 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 89 PID 1448 wrote to memory of 5036 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 87 PID 1448 wrote to memory of 5036 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 87 PID 1448 wrote to memory of 5036 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 87 PID 1448 wrote to memory of 5044 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 93 PID 1448 wrote to memory of 5044 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 93 PID 1448 wrote to memory of 5044 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 93 PID 1448 wrote to memory of 1720 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 96 PID 1448 wrote to memory of 1720 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 96 PID 1448 wrote to memory of 1720 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 96 PID 1448 wrote to memory of 3548 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 98 PID 1448 wrote to memory of 3548 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 98 PID 1448 wrote to memory of 3548 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 98 PID 1448 wrote to memory of 3312 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 99 PID 1448 wrote to memory of 3312 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 99 PID 1448 wrote to memory of 3312 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 99 PID 1448 wrote to memory of 4272 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 104 PID 1448 wrote to memory of 4272 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 104 PID 1448 wrote to memory of 4272 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 104 PID 1448 wrote to memory of 1588 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 100 PID 1448 wrote to memory of 1588 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 100 PID 1448 wrote to memory of 1588 1448 aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe 100 PID 3824 wrote to memory of 4288 3824 cmd.exe 115 PID 3824 wrote to memory of 4288 3824 cmd.exe 115 PID 3824 wrote to memory of 4288 3824 cmd.exe 115 PID 4844 wrote to memory of 320 4844 cmd.exe 114 PID 4844 wrote to memory of 320 4844 cmd.exe 114 PID 4844 wrote to memory of 320 4844 cmd.exe 114 PID 3548 wrote to memory of 228 3548 cmd.exe 106 PID 3548 wrote to memory of 228 3548 cmd.exe 106 PID 3548 wrote to memory of 228 3548 cmd.exe 106 PID 4636 wrote to memory of 216 4636 cmd.exe 112 PID 4636 wrote to memory of 216 4636 cmd.exe 112 PID 4636 wrote to memory of 216 4636 cmd.exe 112 PID 5064 wrote to memory of 208 5064 cmd.exe 108 PID 5064 wrote to memory of 208 5064 cmd.exe 108 PID 5064 wrote to memory of 208 5064 cmd.exe 108 PID 2460 wrote to memory of 308 2460 cmd.exe 107 PID 2460 wrote to memory of 308 2460 cmd.exe 107 PID 2460 wrote to memory of 308 2460 cmd.exe 107 PID 5036 wrote to memory of 2268 5036 cmd.exe 110 PID 5036 wrote to memory of 2268 5036 cmd.exe 110 PID 5036 wrote to memory of 2268 5036 cmd.exe 110 PID 5044 wrote to memory of 2304 5044 cmd.exe 109 PID 5044 wrote to memory of 2304 5044 cmd.exe 109 PID 5044 wrote to memory of 2304 5044 cmd.exe 109 PID 1720 wrote to memory of 3032 1720 cmd.exe 111 PID 1720 wrote to memory of 3032 1720 cmd.exe 111 PID 1720 wrote to memory of 3032 1720 cmd.exe 111 PID 3312 wrote to memory of 3788 3312 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:308
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:4288
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:216
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:2268
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:208
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:320
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:3032
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6814" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6814" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:228
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4239" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4239" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:3788
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3964" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵PID:1588
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3964" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:3752
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7839" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"2⤵PID:4272
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7839" /TR "C:\Users\Admin\AppData\Local\Temp\aaa94ff5950747517471727de7e861d7c81253c94c51dffad799eea11f26d245.exe"3⤵
- Creates scheduled task(s)
PID:4480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 10402⤵
- Program crash
PID:3268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1448 -ip 14481⤵PID:3196