Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
113s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
08/10/2022, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe
Resource
win10-20220812-en
General
-
Target
bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe
-
Size
959KB
-
MD5
f75a4e27da6e00f17a44b25e72ee3d0d
-
SHA1
cf795e3cc788a787d702de22995fcdce6b7e7026
-
SHA256
bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec
-
SHA512
4f1a7ba69137dcd4743b536aa58a4e7e236ab973e3c20e97b2804f6fed80757410bae9ae665998f58b10de69f27263bac9e622fcbf4c2ab9764c80273ff58916
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1744 2540 WerFault.exe 65 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4460 schtasks.exe 4220 schtasks.exe 4272 schtasks.exe 4192 schtasks.exe 4840 schtasks.exe 4800 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2540 wrote to memory of 4972 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 66 PID 2540 wrote to memory of 4972 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 66 PID 2540 wrote to memory of 4972 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 66 PID 2540 wrote to memory of 4904 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 67 PID 2540 wrote to memory of 4904 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 67 PID 2540 wrote to memory of 4904 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 67 PID 2540 wrote to memory of 2144 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 68 PID 2540 wrote to memory of 2144 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 68 PID 2540 wrote to memory of 2144 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 68 PID 2540 wrote to memory of 4992 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 73 PID 2540 wrote to memory of 4992 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 73 PID 2540 wrote to memory of 4992 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 73 PID 2540 wrote to memory of 5064 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 69 PID 2540 wrote to memory of 5064 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 69 PID 2540 wrote to memory of 5064 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 69 PID 2540 wrote to memory of 5084 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 72 PID 2540 wrote to memory of 5084 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 72 PID 2540 wrote to memory of 5084 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 72 PID 2540 wrote to memory of 3632 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 70 PID 2540 wrote to memory of 3632 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 70 PID 2540 wrote to memory of 3632 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 70 PID 2540 wrote to memory of 1700 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 84 PID 2540 wrote to memory of 1700 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 84 PID 2540 wrote to memory of 1700 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 84 PID 2540 wrote to memory of 2628 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 82 PID 2540 wrote to memory of 2628 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 82 PID 2540 wrote to memory of 2628 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 82 PID 2540 wrote to memory of 4476 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 76 PID 2540 wrote to memory of 4476 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 76 PID 2540 wrote to memory of 4476 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 76 PID 2540 wrote to memory of 3412 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 81 PID 2540 wrote to memory of 3412 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 81 PID 2540 wrote to memory of 3412 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 81 PID 2540 wrote to memory of 3368 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 79 PID 2540 wrote to memory of 3368 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 79 PID 2540 wrote to memory of 3368 2540 bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe 79 PID 4972 wrote to memory of 4272 4972 cmd.exe 91 PID 4972 wrote to memory of 4272 4972 cmd.exe 91 PID 4972 wrote to memory of 4272 4972 cmd.exe 91 PID 3632 wrote to memory of 4220 3632 cmd.exe 90 PID 3632 wrote to memory of 4220 3632 cmd.exe 90 PID 3632 wrote to memory of 4220 3632 cmd.exe 90 PID 2144 wrote to memory of 4192 2144 cmd.exe 92 PID 2144 wrote to memory of 4192 2144 cmd.exe 92 PID 2144 wrote to memory of 4192 2144 cmd.exe 92 PID 4992 wrote to memory of 4800 4992 cmd.exe 94 PID 4992 wrote to memory of 4800 4992 cmd.exe 94 PID 4992 wrote to memory of 4800 4992 cmd.exe 94 PID 5084 wrote to memory of 4840 5084 cmd.exe 93 PID 5084 wrote to memory of 4840 5084 cmd.exe 93 PID 5084 wrote to memory of 4840 5084 cmd.exe 93 PID 3412 wrote to memory of 4460 3412 cmd.exe 95 PID 3412 wrote to memory of 4460 3412 cmd.exe 95 PID 3412 wrote to memory of 4460 3412 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"3⤵
- Creates scheduled task(s)
PID:4272
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵PID:4904
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"3⤵
- Creates scheduled task(s)
PID:4192
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵PID:5064
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"3⤵
- Creates scheduled task(s)
PID:4220
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"3⤵
- Creates scheduled task(s)
PID:4840
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"3⤵
- Creates scheduled task(s)
PID:4800
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5519" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵PID:4476
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5477" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵PID:3368
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8802" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8802" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"3⤵
- Creates scheduled task(s)
PID:4460
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2528" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵PID:2628
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\bd92ccc494a1af95ec947edfb3f66671374af72d5bdd1269fd708ee5f2dc1aec.exe"2⤵PID:1700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 13162⤵
- Program crash
PID:1744
-