Overview
overview
10Static
static
10326fcf4806...79.exe
windows7-x64
10326fcf4806...79.exe
windows10-2004-x64
103293f41661...16.exe
windows7-x64
103293f41661...16.exe
windows10-2004-x64
1032af824687...29.exe
windows7-x64
1032af824687...29.exe
windows10-2004-x64
10332a07ad96...b5.exe
windows7-x64
7332a07ad96...b5.exe
windows10-2004-x64
7337f25a258...51.exe
windows7-x64
10337f25a258...51.exe
windows10-2004-x64
1033a6af7047...7b.exe
windows7-x64
1033a6af7047...7b.exe
windows10-2004-x64
10342f2b5aa4...75.exe
windows7-x64
10342f2b5aa4...75.exe
windows10-2004-x64
10344b47e81e...0c.exe
windows7-x64
10344b47e81e...0c.exe
windows10-2004-x64
10345db905b1...8a.exe
windows7-x64
3345db905b1...8a.exe
windows10-2004-x64
134655ac11b...76.exe
windows7-x64
1034655ac11b...76.exe
windows10-2004-x64
1034a292bd76...b7.exe
windows7-x64
1034a292bd76...b7.exe
windows10-2004-x64
1034d765717a...e4.exe
windows7-x64
734d765717a...e4.exe
windows10-2004-x64
634f76de826...a9.exe
windows7-x64
1034f76de826...a9.exe
windows10-2004-x64
10350eba0e7b...2b.exe
windows7-x64
10350eba0e7b...2b.exe
windows10-2004-x64
10353233e5a4...ec.exe
windows7-x64
5353233e5a4...ec.exe
windows10-2004-x64
535459ca752...7b.exe
windows7-x64
1035459ca752...7b.exe
windows10-2004-x64
10Analysis
-
max time kernel
95s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win7-20250207-en
Behavioral task
behavioral20
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win7-20250207-en
Behavioral task
behavioral22
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral23
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral25
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win10v2004-20250314-en
General
-
Target
32af824687697346da2d415bfb80fa29.exe
-
Size
13.1MB
-
MD5
32af824687697346da2d415bfb80fa29
-
SHA1
bc83dec747cc6fc84c61df9df6d0ca5e82227040
-
SHA256
cc1927347aa066e1fca14fe1669362dd817ee950f9727a38e3a7b8ced8553062
-
SHA512
873e74cd1623ee150d3528ba42875048e379e1a577b828215c35f4375bd9817ab25c21113353c3107dc4ab3bcd076a6df5191647c19b373e1472d1b38fbca719
-
SSDEEP
6144:RAIvHAsjfyx0Sd/jkraPjhEe6VlWT8b9AtHqrXjXx4uzTb8M59cTT4l2P:RAWx5raEPVle8/rttzEccTQY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdCorelDRAW.exe" 32af824687697346da2d415bfb80fa29.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Loads dropped DLL 26 IoCs
pid Process 4408 Process not Found 3208 Process not Found 3372 Process not Found 1020 Process not Found 4984 Process not Found 2168 Process not Found 5300 Process not Found 5732 Process not Found 2460 Process not Found 1688 Process not Found 2880 Process not Found 4184 Process not Found 4032 Process not Found 1520 Process not Found 3856 Process not Found 4988 Process not Found 1872 Process not Found 3296 Process not Found 1812 Process not Found 5436 Process not Found 1640 Process not Found 5964 Process not Found 5452 Process not Found 224 Process not Found 6036 Process not Found 2404 Process not Found -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Users\\Admin\\AppData\\Roaming\\xdwdMicrosoft Visual Studio.exe" 32af824687697346da2d415bfb80fa29.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll 32af824687697346da2d415bfb80fa29.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6036 schtasks.exe 1220 schtasks.exe 5788 schtasks.exe 4468 schtasks.exe 1556 schtasks.exe 2832 schtasks.exe 5788 schtasks.exe 5224 schtasks.exe 5072 schtasks.exe 5576 schtasks.exe 1744 schtasks.exe 1032 schtasks.exe 4956 schtasks.exe 6000 schtasks.exe 3064 schtasks.exe 5656 schtasks.exe 4924 schtasks.exe 3452 schtasks.exe 5144 schtasks.exe 4228 schtasks.exe 5652 schtasks.exe 6044 schtasks.exe 4548 schtasks.exe 376 schtasks.exe 5932 schtasks.exe 4420 schtasks.exe 5892 schtasks.exe 3576 schtasks.exe 2080 schtasks.exe 5652 schtasks.exe 5680 schtasks.exe 1812 schtasks.exe 1396 schtasks.exe 5844 schtasks.exe 3196 schtasks.exe 3316 schtasks.exe 2264 schtasks.exe 5868 schtasks.exe 3880 schtasks.exe 2636 schtasks.exe 3820 schtasks.exe 5004 schtasks.exe 5260 schtasks.exe 5024 schtasks.exe 3056 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4740 32af824687697346da2d415bfb80fa29.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4740 wrote to memory of 5052 4740 32af824687697346da2d415bfb80fa29.exe 101 PID 4740 wrote to memory of 5052 4740 32af824687697346da2d415bfb80fa29.exe 101 PID 5052 wrote to memory of 5144 5052 CMD.exe 103 PID 5052 wrote to memory of 5144 5052 CMD.exe 103 PID 4740 wrote to memory of 5012 4740 32af824687697346da2d415bfb80fa29.exe 104 PID 4740 wrote to memory of 5012 4740 32af824687697346da2d415bfb80fa29.exe 104 PID 5012 wrote to memory of 6000 5012 CMD.exe 106 PID 5012 wrote to memory of 6000 5012 CMD.exe 106 PID 4740 wrote to memory of 4920 4740 32af824687697346da2d415bfb80fa29.exe 107 PID 4740 wrote to memory of 4920 4740 32af824687697346da2d415bfb80fa29.exe 107 PID 4920 wrote to memory of 5868 4920 CMD.exe 109 PID 4920 wrote to memory of 5868 4920 CMD.exe 109 PID 4740 wrote to memory of 5376 4740 32af824687697346da2d415bfb80fa29.exe 111 PID 4740 wrote to memory of 5376 4740 32af824687697346da2d415bfb80fa29.exe 111 PID 5376 wrote to memory of 2832 5376 CMD.exe 113 PID 5376 wrote to memory of 2832 5376 CMD.exe 113 PID 4740 wrote to memory of 4236 4740 32af824687697346da2d415bfb80fa29.exe 114 PID 4740 wrote to memory of 4236 4740 32af824687697346da2d415bfb80fa29.exe 114 PID 4236 wrote to memory of 3064 4236 CMD.exe 116 PID 4236 wrote to memory of 3064 4236 CMD.exe 116 PID 4740 wrote to memory of 3648 4740 32af824687697346da2d415bfb80fa29.exe 117 PID 4740 wrote to memory of 3648 4740 32af824687697346da2d415bfb80fa29.exe 117 PID 3648 wrote to memory of 3880 3648 CMD.exe 119 PID 3648 wrote to memory of 3880 3648 CMD.exe 119 PID 4740 wrote to memory of 824 4740 32af824687697346da2d415bfb80fa29.exe 120 PID 4740 wrote to memory of 824 4740 32af824687697346da2d415bfb80fa29.exe 120 PID 824 wrote to memory of 6036 824 CMD.exe 122 PID 824 wrote to memory of 6036 824 CMD.exe 122 PID 4740 wrote to memory of 1940 4740 32af824687697346da2d415bfb80fa29.exe 125 PID 4740 wrote to memory of 1940 4740 32af824687697346da2d415bfb80fa29.exe 125 PID 1940 wrote to memory of 4548 1940 CMD.exe 127 PID 1940 wrote to memory of 4548 1940 CMD.exe 127 PID 4740 wrote to memory of 5140 4740 32af824687697346da2d415bfb80fa29.exe 129 PID 4740 wrote to memory of 5140 4740 32af824687697346da2d415bfb80fa29.exe 129 PID 5140 wrote to memory of 2636 5140 CMD.exe 131 PID 5140 wrote to memory of 2636 5140 CMD.exe 131 PID 4740 wrote to memory of 4668 4740 32af824687697346da2d415bfb80fa29.exe 132 PID 4740 wrote to memory of 4668 4740 32af824687697346da2d415bfb80fa29.exe 132 PID 4668 wrote to memory of 1812 4668 CMD.exe 134 PID 4668 wrote to memory of 1812 4668 CMD.exe 134 PID 4740 wrote to memory of 4700 4740 32af824687697346da2d415bfb80fa29.exe 136 PID 4740 wrote to memory of 4700 4740 32af824687697346da2d415bfb80fa29.exe 136 PID 4700 wrote to memory of 1220 4700 CMD.exe 138 PID 4700 wrote to memory of 1220 4700 CMD.exe 138 PID 4740 wrote to memory of 5072 4740 32af824687697346da2d415bfb80fa29.exe 139 PID 4740 wrote to memory of 5072 4740 32af824687697346da2d415bfb80fa29.exe 139 PID 5072 wrote to memory of 4228 5072 CMD.exe 141 PID 5072 wrote to memory of 4228 5072 CMD.exe 141 PID 4740 wrote to memory of 2868 4740 32af824687697346da2d415bfb80fa29.exe 142 PID 4740 wrote to memory of 2868 4740 32af824687697346da2d415bfb80fa29.exe 142 PID 2868 wrote to memory of 376 2868 CMD.exe 144 PID 2868 wrote to memory of 376 2868 CMD.exe 144 PID 4740 wrote to memory of 1632 4740 32af824687697346da2d415bfb80fa29.exe 145 PID 4740 wrote to memory of 1632 4740 32af824687697346da2d415bfb80fa29.exe 145 PID 1632 wrote to memory of 5932 1632 CMD.exe 147 PID 1632 wrote to memory of 5932 1632 CMD.exe 147 PID 4740 wrote to memory of 2968 4740 32af824687697346da2d415bfb80fa29.exe 148 PID 4740 wrote to memory of 2968 4740 32af824687697346da2d415bfb80fa29.exe 148 PID 2968 wrote to memory of 5024 2968 CMD.exe 150 PID 2968 wrote to memory of 5024 2968 CMD.exe 150 PID 4740 wrote to memory of 4968 4740 32af824687697346da2d415bfb80fa29.exe 151 PID 4740 wrote to memory of 4968 4740 32af824687697346da2d415bfb80fa29.exe 151 PID 4968 wrote to memory of 1396 4968 CMD.exe 153 PID 4968 wrote to memory of 1396 4968 CMD.exe 153 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe"C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SYSTEM32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5144
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:6000
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5868
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2832
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3064
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3880
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:6036
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4548
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2636
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1812
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1220
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4228
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:376
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5932
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5024
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1396
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3612
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3056
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:4340
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5788
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:4744
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4420
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:5124
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5224
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1744
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5892
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2836
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5844
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:4920
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5072
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:5408
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3196
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3064
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3820
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:4412
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5652
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:668
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5680
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1448
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5004
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:4416
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5788
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:5160
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3576
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1940
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5576
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1408
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5656
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2352
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5260
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:684
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1744
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:5012
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2080
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:6012
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1032
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3280
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3316
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1484
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4956
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3708
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5652
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:264
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:6044
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2528
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2264
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:5212
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4468
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3780
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4924
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:5576
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3452
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3224
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1556
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD527338f1263ff0087d4066de33658cc70
SHA1769383c867ed95809f6ae3e805994e4194d865b0
SHA256bff6bc1805dc7939d3fdd921663a73a607cfc48a3297d2f2e78d3a2838ad0a06
SHA512c86892a64e04cc426f7504acccafb06a479ea1b26e5171caeae210b6af5489d1b88f4be0b8904641e5a5e3b187f9fd0c471cd393937de9135f1d9c47cba98c29
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6