Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10326fcf4806...79.exe
windows7-x64
10326fcf4806...79.exe
windows10-2004-x64
103293f41661...16.exe
windows7-x64
103293f41661...16.exe
windows10-2004-x64
1032af824687...29.exe
windows7-x64
1032af824687...29.exe
windows10-2004-x64
10332a07ad96...b5.exe
windows7-x64
7332a07ad96...b5.exe
windows10-2004-x64
7337f25a258...51.exe
windows7-x64
10337f25a258...51.exe
windows10-2004-x64
1033a6af7047...7b.exe
windows7-x64
1033a6af7047...7b.exe
windows10-2004-x64
10342f2b5aa4...75.exe
windows7-x64
10342f2b5aa4...75.exe
windows10-2004-x64
10344b47e81e...0c.exe
windows7-x64
10344b47e81e...0c.exe
windows10-2004-x64
10345db905b1...8a.exe
windows7-x64
3345db905b1...8a.exe
windows10-2004-x64
134655ac11b...76.exe
windows7-x64
1034655ac11b...76.exe
windows10-2004-x64
1034a292bd76...b7.exe
windows7-x64
1034a292bd76...b7.exe
windows10-2004-x64
1034d765717a...e4.exe
windows7-x64
734d765717a...e4.exe
windows10-2004-x64
634f76de826...a9.exe
windows7-x64
1034f76de826...a9.exe
windows10-2004-x64
10350eba0e7b...2b.exe
windows7-x64
10350eba0e7b...2b.exe
windows10-2004-x64
10353233e5a4...ec.exe
windows7-x64
5353233e5a4...ec.exe
windows10-2004-x64
535459ca752...7b.exe
windows7-x64
1035459ca752...7b.exe
windows10-2004-x64
10Analysis
-
max time kernel
95s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win7-20250207-en
Behavioral task
behavioral20
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win7-20250207-en
Behavioral task
behavioral22
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral23
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral25
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win10v2004-20250314-en
General
-
Target
32af824687697346da2d415bfb80fa29.exe
-
Size
13.1MB
-
MD5
32af824687697346da2d415bfb80fa29
-
SHA1
bc83dec747cc6fc84c61df9df6d0ca5e82227040
-
SHA256
cc1927347aa066e1fca14fe1669362dd817ee950f9727a38e3a7b8ced8553062
-
SHA512
873e74cd1623ee150d3528ba42875048e379e1a577b828215c35f4375bd9817ab25c21113353c3107dc4ab3bcd076a6df5191647c19b373e1472d1b38fbca719
-
SSDEEP
6144:RAIvHAsjfyx0Sd/jkraPjhEe6VlWT8b9AtHqrXjXx4uzTb8M59cTT4l2P:RAWx5raEPVle8/rttzEccTQY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\xdwdCorelDRAW.exe" 32af824687697346da2d415bfb80fa29.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Users\\Admin\\AppData\\Roaming\\xdwdMicrosoft Visual Studio.exe" 32af824687697346da2d415bfb80fa29.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll 32af824687697346da2d415bfb80fa29.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2656 schtasks.exe 1288 schtasks.exe 1776 schtasks.exe 1804 schtasks.exe 1320 schtasks.exe 2860 schtasks.exe 876 schtasks.exe 2784 schtasks.exe 2620 schtasks.exe 2660 schtasks.exe 2128 schtasks.exe 1380 schtasks.exe 1976 schtasks.exe 1540 schtasks.exe 1636 schtasks.exe 2592 schtasks.exe 2860 schtasks.exe 2672 schtasks.exe 2792 schtasks.exe 780 schtasks.exe 1680 schtasks.exe 2104 schtasks.exe 936 schtasks.exe 2744 schtasks.exe 1068 schtasks.exe 912 schtasks.exe 2732 schtasks.exe 2780 schtasks.exe 1992 schtasks.exe 1552 schtasks.exe 1656 schtasks.exe 2116 schtasks.exe 1716 schtasks.exe 1748 schtasks.exe 2468 schtasks.exe 2896 schtasks.exe 2796 schtasks.exe 712 schtasks.exe 2684 schtasks.exe 304 schtasks.exe 2804 schtasks.exe 1852 schtasks.exe 824 schtasks.exe 1052 schtasks.exe 876 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 1560 CMD.exe 2860 schtasks.exe 2016 CMD.exe 2672 schtasks.exe 2924 CMD.exe 2792 schtasks.exe 2596 CMD.exe 1288 schtasks.exe 1000 CMD.exe 1552 schtasks.exe 2364 CMD.exe 780 schtasks.exe 2420 CMD.exe 1776 schtasks.exe 2716 CMD.exe 2804 schtasks.exe 2724 CMD.exe 2660 schtasks.exe 280 CMD.exe 2860 schtasks.exe 2940 CMD.exe 1804 schtasks.exe 380 CMD.exe 1656 schtasks.exe 844 CMD.exe 2128 schtasks.exe 1848 CMD.exe 1380 schtasks.exe 1008 CMD.exe 2116 schtasks.exe 2300 CMD.exe 1068 schtasks.exe 876 schtasks.exe 2124 CMD.exe 2784 schtasks.exe 2308 CMD.exe 1680 schtasks.exe 1536 CMD.exe 2796 schtasks.exe 2888 CMD.exe 1976 schtasks.exe 1416 CMD.exe 1852 schtasks.exe 3040 CMD.exe 712 schtasks.exe 1796 CMD.exe 912 schtasks.exe 2820 CMD.exe 1540 schtasks.exe 1776 CMD.exe 1716 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1908 32af824687697346da2d415bfb80fa29.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2736 1908 32af824687697346da2d415bfb80fa29.exe 32 PID 1908 wrote to memory of 2736 1908 32af824687697346da2d415bfb80fa29.exe 32 PID 1908 wrote to memory of 2736 1908 32af824687697346da2d415bfb80fa29.exe 32 PID 2736 wrote to memory of 2744 2736 CMD.exe 34 PID 2736 wrote to memory of 2744 2736 CMD.exe 34 PID 2736 wrote to memory of 2744 2736 CMD.exe 34 PID 1908 wrote to memory of 1720 1908 32af824687697346da2d415bfb80fa29.exe 35 PID 1908 wrote to memory of 1720 1908 32af824687697346da2d415bfb80fa29.exe 35 PID 1908 wrote to memory of 1720 1908 32af824687697346da2d415bfb80fa29.exe 35 PID 1720 wrote to memory of 2656 1720 CMD.exe 37 PID 1720 wrote to memory of 2656 1720 CMD.exe 37 PID 1720 wrote to memory of 2656 1720 CMD.exe 37 PID 1908 wrote to memory of 1164 1908 32af824687697346da2d415bfb80fa29.exe 38 PID 1908 wrote to memory of 1164 1908 32af824687697346da2d415bfb80fa29.exe 38 PID 1908 wrote to memory of 1164 1908 32af824687697346da2d415bfb80fa29.exe 38 PID 1164 wrote to memory of 1320 1164 CMD.exe 40 PID 1164 wrote to memory of 1320 1164 CMD.exe 40 PID 1164 wrote to memory of 1320 1164 CMD.exe 40 PID 1908 wrote to memory of 1560 1908 32af824687697346da2d415bfb80fa29.exe 41 PID 1908 wrote to memory of 1560 1908 32af824687697346da2d415bfb80fa29.exe 41 PID 1908 wrote to memory of 1560 1908 32af824687697346da2d415bfb80fa29.exe 41 PID 1560 wrote to memory of 2860 1560 CMD.exe 43 PID 1560 wrote to memory of 2860 1560 CMD.exe 43 PID 1560 wrote to memory of 2860 1560 CMD.exe 43 PID 1908 wrote to memory of 2016 1908 32af824687697346da2d415bfb80fa29.exe 44 PID 1908 wrote to memory of 2016 1908 32af824687697346da2d415bfb80fa29.exe 44 PID 1908 wrote to memory of 2016 1908 32af824687697346da2d415bfb80fa29.exe 44 PID 2016 wrote to memory of 2672 2016 CMD.exe 46 PID 2016 wrote to memory of 2672 2016 CMD.exe 46 PID 2016 wrote to memory of 2672 2016 CMD.exe 46 PID 1908 wrote to memory of 2924 1908 32af824687697346da2d415bfb80fa29.exe 47 PID 1908 wrote to memory of 2924 1908 32af824687697346da2d415bfb80fa29.exe 47 PID 1908 wrote to memory of 2924 1908 32af824687697346da2d415bfb80fa29.exe 47 PID 2924 wrote to memory of 2792 2924 CMD.exe 49 PID 2924 wrote to memory of 2792 2924 CMD.exe 49 PID 2924 wrote to memory of 2792 2924 CMD.exe 49 PID 1908 wrote to memory of 2596 1908 32af824687697346da2d415bfb80fa29.exe 50 PID 1908 wrote to memory of 2596 1908 32af824687697346da2d415bfb80fa29.exe 50 PID 1908 wrote to memory of 2596 1908 32af824687697346da2d415bfb80fa29.exe 50 PID 2596 wrote to memory of 1288 2596 CMD.exe 52 PID 2596 wrote to memory of 1288 2596 CMD.exe 52 PID 2596 wrote to memory of 1288 2596 CMD.exe 52 PID 1908 wrote to memory of 1000 1908 32af824687697346da2d415bfb80fa29.exe 53 PID 1908 wrote to memory of 1000 1908 32af824687697346da2d415bfb80fa29.exe 53 PID 1908 wrote to memory of 1000 1908 32af824687697346da2d415bfb80fa29.exe 53 PID 1000 wrote to memory of 1552 1000 CMD.exe 55 PID 1000 wrote to memory of 1552 1000 CMD.exe 55 PID 1000 wrote to memory of 1552 1000 CMD.exe 55 PID 1908 wrote to memory of 2364 1908 32af824687697346da2d415bfb80fa29.exe 56 PID 1908 wrote to memory of 2364 1908 32af824687697346da2d415bfb80fa29.exe 56 PID 1908 wrote to memory of 2364 1908 32af824687697346da2d415bfb80fa29.exe 56 PID 2364 wrote to memory of 780 2364 CMD.exe 58 PID 2364 wrote to memory of 780 2364 CMD.exe 58 PID 2364 wrote to memory of 780 2364 CMD.exe 58 PID 1908 wrote to memory of 2420 1908 32af824687697346da2d415bfb80fa29.exe 59 PID 1908 wrote to memory of 2420 1908 32af824687697346da2d415bfb80fa29.exe 59 PID 1908 wrote to memory of 2420 1908 32af824687697346da2d415bfb80fa29.exe 59 PID 2420 wrote to memory of 1776 2420 CMD.exe 61 PID 2420 wrote to memory of 1776 2420 CMD.exe 61 PID 2420 wrote to memory of 1776 2420 CMD.exe 61 PID 1908 wrote to memory of 2716 1908 32af824687697346da2d415bfb80fa29.exe 62 PID 1908 wrote to memory of 2716 1908 32af824687697346da2d415bfb80fa29.exe 62 PID 1908 wrote to memory of 2716 1908 32af824687697346da2d415bfb80fa29.exe 62 PID 2716 wrote to memory of 2804 2716 CMD.exe 64 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe"C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2744
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2656
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1320
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2672
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2792
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1288
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1552
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:780
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2804
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2660
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:280 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1804
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:380 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1656
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:844 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2128
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1380
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1008 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3020
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:876
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2796
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1416 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:712
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:912
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2344
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2620
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2780
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2684
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1468
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2732
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2368
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2104
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1556
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:304
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2096
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1748
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:712
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2468
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:924
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:824
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1540
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1052
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2256
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:876
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2728
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2896
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2284
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2780
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2124
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1992
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2600
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:936
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2816
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1636
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1972
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2592
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6