Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
11/10/2022, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe
Resource
win10-20220901-en
General
-
Target
e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe
-
Size
966KB
-
MD5
87eaa2d3c97a0b151c25a6be9921048d
-
SHA1
cfd5a55ca92ff1f1f7fdb503c2223edbae514fdc
-
SHA256
e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6
-
SHA512
1b49dc39d6501cfdfcdbe5395f240e2676f168236625293e6dbba3e4c20b514a39cfcb23a94e8296494ccf56aa3c4b9a040556480dbaba2ac95808304be9fcec
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4100 4944 WerFault.exe 65 -
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4916 schtasks.exe 4824 schtasks.exe 3472 schtasks.exe 3648 schtasks.exe 4540 schtasks.exe 4716 schtasks.exe 4696 schtasks.exe 4724 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4628 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 66 PID 4944 wrote to memory of 4628 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 66 PID 4944 wrote to memory of 4628 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 66 PID 4944 wrote to memory of 2820 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 67 PID 4944 wrote to memory of 2820 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 67 PID 4944 wrote to memory of 2820 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 67 PID 4944 wrote to memory of 4560 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 69 PID 4944 wrote to memory of 4560 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 69 PID 4944 wrote to memory of 4560 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 69 PID 4944 wrote to memory of 2232 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 68 PID 4944 wrote to memory of 2232 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 68 PID 4944 wrote to memory of 2232 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 68 PID 4944 wrote to memory of 2884 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 70 PID 4944 wrote to memory of 2884 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 70 PID 4944 wrote to memory of 2884 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 70 PID 4944 wrote to memory of 3624 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 75 PID 4944 wrote to memory of 3624 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 75 PID 4944 wrote to memory of 3624 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 75 PID 4944 wrote to memory of 3772 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 74 PID 4944 wrote to memory of 3772 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 74 PID 4944 wrote to memory of 3772 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 74 PID 4944 wrote to memory of 1360 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 71 PID 4944 wrote to memory of 1360 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 71 PID 4944 wrote to memory of 1360 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 71 PID 4944 wrote to memory of 4412 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 77 PID 4944 wrote to memory of 4412 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 77 PID 4944 wrote to memory of 4412 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 77 PID 4944 wrote to memory of 3612 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 78 PID 4944 wrote to memory of 3612 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 78 PID 4944 wrote to memory of 3612 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 78 PID 4944 wrote to memory of 4212 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 82 PID 4944 wrote to memory of 4212 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 82 PID 4944 wrote to memory of 4212 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 82 PID 4944 wrote to memory of 4572 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 81 PID 4944 wrote to memory of 4572 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 81 PID 4944 wrote to memory of 4572 4944 e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe 81 PID 2232 wrote to memory of 3648 2232 cmd.exe 91 PID 2232 wrote to memory of 3648 2232 cmd.exe 91 PID 2232 wrote to memory of 3648 2232 cmd.exe 91 PID 3772 wrote to memory of 3472 3772 cmd.exe 90 PID 3772 wrote to memory of 3472 3772 cmd.exe 90 PID 3772 wrote to memory of 3472 3772 cmd.exe 90 PID 4560 wrote to memory of 4540 4560 cmd.exe 92 PID 4560 wrote to memory of 4540 4560 cmd.exe 92 PID 4560 wrote to memory of 4540 4560 cmd.exe 92 PID 2820 wrote to memory of 4716 2820 cmd.exe 93 PID 2820 wrote to memory of 4716 2820 cmd.exe 93 PID 2820 wrote to memory of 4716 2820 cmd.exe 93 PID 3624 wrote to memory of 4724 3624 cmd.exe 95 PID 3624 wrote to memory of 4724 3624 cmd.exe 95 PID 3624 wrote to memory of 4724 3624 cmd.exe 95 PID 4628 wrote to memory of 4696 4628 cmd.exe 94 PID 4628 wrote to memory of 4696 4628 cmd.exe 94 PID 4628 wrote to memory of 4696 4628 cmd.exe 94 PID 3612 wrote to memory of 4916 3612 cmd.exe 96 PID 3612 wrote to memory of 4916 3612 cmd.exe 96 PID 3612 wrote to memory of 4916 3612 cmd.exe 96 PID 4572 wrote to memory of 4824 4572 cmd.exe 97 PID 4572 wrote to memory of 4824 4572 cmd.exe 97 PID 4572 wrote to memory of 4824 4572 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:4696
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:4716
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:3648
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:4540
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵PID:2884
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵PID:1360
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:3472
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:4724
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1483" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵PID:4412
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2178" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2178" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:4916
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5935" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5935" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"3⤵
- Creates scheduled task(s)
PID:4824
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5675" /TR "C:\Users\Admin\AppData\Local\Temp\e4ae711fc3b5a30d89a019b2d4dba107b7ff4437cb6797bc3d728938437f4ca6.exe"2⤵PID:4212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 13842⤵
- Program crash
PID:4100
-