Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2022, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe
-
Size
964KB
-
MD5
159ee6a5702b05311ebfa08d2b979659
-
SHA1
afa2a88aefa2609eec43bcd1be8c5a69706bbb84
-
SHA256
042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa
-
SHA512
cee93fa39533c325f8acfea48cb442207e30a0f84b77f0ea5c2944e932fcf62408badc7c939b6602090714bbed0a393bc5010aec564395b3e6b3bf0dd5a3bbbc
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3288 1244 WerFault.exe 80 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4308 schtasks.exe 2644 schtasks.exe 1676 schtasks.exe 3196 schtasks.exe 4776 schtasks.exe 224 schtasks.exe 316 schtasks.exe 4664 schtasks.exe 3348 schtasks.exe 1148 schtasks.exe 3032 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1244 wrote to memory of 1960 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 81 PID 1244 wrote to memory of 1960 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 81 PID 1244 wrote to memory of 1960 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 81 PID 1244 wrote to memory of 2084 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 82 PID 1244 wrote to memory of 2084 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 82 PID 1244 wrote to memory of 2084 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 82 PID 1244 wrote to memory of 4148 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 94 PID 1244 wrote to memory of 4148 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 94 PID 1244 wrote to memory of 4148 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 94 PID 1244 wrote to memory of 4820 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 84 PID 1244 wrote to memory of 4820 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 84 PID 1244 wrote to memory of 4820 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 84 PID 1244 wrote to memory of 1528 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 85 PID 1244 wrote to memory of 1528 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 85 PID 1244 wrote to memory of 1528 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 85 PID 1244 wrote to memory of 4932 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 90 PID 1244 wrote to memory of 4932 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 90 PID 1244 wrote to memory of 4932 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 90 PID 1244 wrote to memory of 4692 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 86 PID 1244 wrote to memory of 4692 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 86 PID 1244 wrote to memory of 4692 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 86 PID 1244 wrote to memory of 1112 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 87 PID 1244 wrote to memory of 1112 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 87 PID 1244 wrote to memory of 1112 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 87 PID 1244 wrote to memory of 4160 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 96 PID 1244 wrote to memory of 4160 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 96 PID 1244 wrote to memory of 4160 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 96 PID 1244 wrote to memory of 4944 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 97 PID 1244 wrote to memory of 4944 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 97 PID 1244 wrote to memory of 4944 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 97 PID 1244 wrote to memory of 400 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 99 PID 1244 wrote to memory of 400 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 99 PID 1244 wrote to memory of 400 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 99 PID 1244 wrote to memory of 1860 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 102 PID 1244 wrote to memory of 1860 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 102 PID 1244 wrote to memory of 1860 1244 042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe 102 PID 4160 wrote to memory of 1148 4160 cmd.exe 115 PID 4160 wrote to memory of 1148 4160 cmd.exe 115 PID 4160 wrote to memory of 1148 4160 cmd.exe 115 PID 4932 wrote to memory of 3348 4932 cmd.exe 114 PID 4932 wrote to memory of 3348 4932 cmd.exe 114 PID 4932 wrote to memory of 3348 4932 cmd.exe 114 PID 4820 wrote to memory of 4664 4820 cmd.exe 113 PID 4820 wrote to memory of 4664 4820 cmd.exe 113 PID 4820 wrote to memory of 4664 4820 cmd.exe 113 PID 1860 wrote to memory of 316 1860 cmd.exe 112 PID 1860 wrote to memory of 316 1860 cmd.exe 112 PID 1860 wrote to memory of 316 1860 cmd.exe 112 PID 4944 wrote to memory of 224 4944 cmd.exe 111 PID 4944 wrote to memory of 224 4944 cmd.exe 111 PID 4944 wrote to memory of 224 4944 cmd.exe 111 PID 2084 wrote to memory of 4776 2084 cmd.exe 110 PID 2084 wrote to memory of 4776 2084 cmd.exe 110 PID 2084 wrote to memory of 4776 2084 cmd.exe 110 PID 400 wrote to memory of 2644 400 cmd.exe 109 PID 400 wrote to memory of 2644 400 cmd.exe 109 PID 400 wrote to memory of 2644 400 cmd.exe 109 PID 1112 wrote to memory of 1676 1112 cmd.exe 105 PID 1112 wrote to memory of 1676 1112 cmd.exe 105 PID 1112 wrote to memory of 1676 1112 cmd.exe 105 PID 4692 wrote to memory of 3196 4692 cmd.exe 108 PID 4692 wrote to memory of 3196 4692 cmd.exe 108 PID 4692 wrote to memory of 3196 4692 cmd.exe 108 PID 1528 wrote to memory of 3032 1528 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:4776
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:4664
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:3032
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:3196
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:1676
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:3348
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵PID:4148
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:4308
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8526" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8526" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:1148
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2758" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2758" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:224
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3772" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3772" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:2644
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk821" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk821" /TR "C:\Users\Admin\AppData\Local\Temp\042213fa77692c0be940220b5f2a8e5be8fec684522f99033105a9e767bf36fa.exe"3⤵
- Creates scheduled task(s)
PID:316
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 13682⤵
- Program crash
PID:3288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1244 -ip 12441⤵PID:1888