Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2022, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe
-
Size
965KB
-
MD5
d228c8ca8ed19c699d365dd9df852b51
-
SHA1
1de9f54da322aef6e27bdce73d1e4cdeeaf33c97
-
SHA256
ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f
-
SHA512
9a36b83922065e52a17ca88f5ca58eb6f53f1cebf6442a043fc5cf6f29f6c94da33b4c96cef8ac5c92e2eec9957f070c295b15405e294f83c0ff78dad0692cfb
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3308 4988 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2376 schtasks.exe 4900 schtasks.exe 2272 schtasks.exe 2252 schtasks.exe 2348 schtasks.exe 440 schtasks.exe 2064 schtasks.exe 672 schtasks.exe 4836 schtasks.exe 4780 schtasks.exe 4644 schtasks.exe 4228 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 4588 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 82 PID 4988 wrote to memory of 4588 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 82 PID 4988 wrote to memory of 4588 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 82 PID 4988 wrote to memory of 3436 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 83 PID 4988 wrote to memory of 3436 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 83 PID 4988 wrote to memory of 3436 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 83 PID 4988 wrote to memory of 4564 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 84 PID 4988 wrote to memory of 4564 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 84 PID 4988 wrote to memory of 4564 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 84 PID 4988 wrote to memory of 396 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 105 PID 4988 wrote to memory of 396 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 105 PID 4988 wrote to memory of 396 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 105 PID 4988 wrote to memory of 2140 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 102 PID 4988 wrote to memory of 2140 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 102 PID 4988 wrote to memory of 2140 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 102 PID 4988 wrote to memory of 4552 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 87 PID 4988 wrote to memory of 4552 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 87 PID 4988 wrote to memory of 4552 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 87 PID 4988 wrote to memory of 3912 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 88 PID 4988 wrote to memory of 3912 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 88 PID 4988 wrote to memory of 3912 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 88 PID 4988 wrote to memory of 804 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 91 PID 4988 wrote to memory of 804 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 91 PID 4988 wrote to memory of 804 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 91 PID 4988 wrote to memory of 1984 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 90 PID 4988 wrote to memory of 1984 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 90 PID 4988 wrote to memory of 1984 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 90 PID 4988 wrote to memory of 216 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 98 PID 4988 wrote to memory of 216 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 98 PID 4988 wrote to memory of 216 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 98 PID 4988 wrote to memory of 2596 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 93 PID 4988 wrote to memory of 2596 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 93 PID 4988 wrote to memory of 2596 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 93 PID 4988 wrote to memory of 1508 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 94 PID 4988 wrote to memory of 1508 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 94 PID 4988 wrote to memory of 1508 4988 ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe 94 PID 4564 wrote to memory of 4780 4564 cmd.exe 117 PID 4564 wrote to memory of 4780 4564 cmd.exe 117 PID 4564 wrote to memory of 4780 4564 cmd.exe 117 PID 2596 wrote to memory of 4836 2596 cmd.exe 115 PID 2596 wrote to memory of 4836 2596 cmd.exe 115 PID 2596 wrote to memory of 4836 2596 cmd.exe 115 PID 3436 wrote to memory of 4228 3436 cmd.exe 116 PID 3436 wrote to memory of 4228 3436 cmd.exe 116 PID 3436 wrote to memory of 4228 3436 cmd.exe 116 PID 4552 wrote to memory of 4900 4552 cmd.exe 114 PID 4552 wrote to memory of 4900 4552 cmd.exe 114 PID 4552 wrote to memory of 4900 4552 cmd.exe 114 PID 4588 wrote to memory of 2376 4588 cmd.exe 113 PID 4588 wrote to memory of 2376 4588 cmd.exe 113 PID 4588 wrote to memory of 2376 4588 cmd.exe 113 PID 396 wrote to memory of 672 396 cmd.exe 112 PID 396 wrote to memory of 672 396 cmd.exe 112 PID 396 wrote to memory of 672 396 cmd.exe 112 PID 2140 wrote to memory of 2064 2140 cmd.exe 111 PID 2140 wrote to memory of 2064 2140 cmd.exe 111 PID 2140 wrote to memory of 2064 2140 cmd.exe 111 PID 1508 wrote to memory of 440 1508 cmd.exe 110 PID 1508 wrote to memory of 440 1508 cmd.exe 110 PID 1508 wrote to memory of 440 1508 cmd.exe 110 PID 216 wrote to memory of 2348 216 cmd.exe 109 PID 216 wrote to memory of 2348 216 cmd.exe 109 PID 216 wrote to memory of 2348 216 cmd.exe 109 PID 3912 wrote to memory of 4644 3912 cmd.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:2376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:4228
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:4780
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:4644
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3838" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵PID:1984
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3838" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:2272
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵PID:804
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:2252
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1456" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1456" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:4836
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2144" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2144" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:440
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9968" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9968" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:2348
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:2064
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\ee9180284a39e95ce7534e1dbf0e893626335195d402e79dabbd6f122185004f.exe"3⤵
- Creates scheduled task(s)
PID:672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 13682⤵
- Program crash
PID:3308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4988 -ip 49881⤵PID:4088