Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10326fcf4806...79.exe
windows7-x64
10326fcf4806...79.exe
windows10-2004-x64
103293f41661...16.exe
windows7-x64
103293f41661...16.exe
windows10-2004-x64
1032af824687...29.exe
windows7-x64
1032af824687...29.exe
windows10-2004-x64
10332a07ad96...b5.exe
windows7-x64
7332a07ad96...b5.exe
windows10-2004-x64
7337f25a258...51.exe
windows7-x64
10337f25a258...51.exe
windows10-2004-x64
1033a6af7047...7b.exe
windows7-x64
1033a6af7047...7b.exe
windows10-2004-x64
10342f2b5aa4...75.exe
windows7-x64
10342f2b5aa4...75.exe
windows10-2004-x64
10344b47e81e...0c.exe
windows7-x64
10344b47e81e...0c.exe
windows10-2004-x64
10345db905b1...8a.exe
windows7-x64
3345db905b1...8a.exe
windows10-2004-x64
134655ac11b...76.exe
windows7-x64
1034655ac11b...76.exe
windows10-2004-x64
1034a292bd76...b7.exe
windows7-x64
1034a292bd76...b7.exe
windows10-2004-x64
1034d765717a...e4.exe
windows7-x64
1034d765717a...e4.exe
windows10-2004-x64
1034f76de826...a9.exe
windows7-x64
1034f76de826...a9.exe
windows10-2004-x64
10350eba0e7b...2b.exe
windows7-x64
10350eba0e7b...2b.exe
windows10-2004-x64
10353233e5a4...ec.exe
windows7-x64
5353233e5a4...ec.exe
windows10-2004-x64
535459ca752...7b.exe
windows7-x64
1035459ca752...7b.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:09
Behavioral task
behavioral1
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win10v2004-20250314-en
General
-
Target
32af824687697346da2d415bfb80fa29.exe
-
Size
13.1MB
-
MD5
32af824687697346da2d415bfb80fa29
-
SHA1
bc83dec747cc6fc84c61df9df6d0ca5e82227040
-
SHA256
cc1927347aa066e1fca14fe1669362dd817ee950f9727a38e3a7b8ced8553062
-
SHA512
873e74cd1623ee150d3528ba42875048e379e1a577b828215c35f4375bd9817ab25c21113353c3107dc4ab3bcd076a6df5191647c19b373e1472d1b38fbca719
-
SSDEEP
6144:RAIvHAsjfyx0Sd/jkraPjhEe6VlWT8b9AtHqrXjXx4uzTb8M59cTT4l2P:RAWx5raEPVle8/rttzEccTQY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\xdwdCorelDRAW.exe" 32af824687697346da2d415bfb80fa29.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Users\\Admin\\AppData\\Roaming\\xdwdMicrosoft Visual Studio.exe" 32af824687697346da2d415bfb80fa29.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll 32af824687697346da2d415bfb80fa29.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 46 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1152 schtasks.exe 1304 schtasks.exe 2652 schtasks.exe 1960 schtasks.exe 708 schtasks.exe 2208 schtasks.exe 2944 schtasks.exe 1300 schtasks.exe 680 schtasks.exe 2572 schtasks.exe 2676 schtasks.exe 1804 schtasks.exe 2424 schtasks.exe 1056 schtasks.exe 1680 schtasks.exe 1868 schtasks.exe 2452 schtasks.exe 972 schtasks.exe 1060 schtasks.exe 2936 schtasks.exe 1104 schtasks.exe 1852 schtasks.exe 3012 schtasks.exe 2836 schtasks.exe 1348 schtasks.exe 2036 schtasks.exe 2552 schtasks.exe 2100 schtasks.exe 3060 schtasks.exe 1976 schtasks.exe 2876 schtasks.exe 1720 schtasks.exe 2288 schtasks.exe 1580 schtasks.exe 1600 schtasks.exe 3032 schtasks.exe 2900 schtasks.exe 1672 schtasks.exe 2312 schtasks.exe 2380 schtasks.exe 2596 schtasks.exe 1576 schtasks.exe 1736 schtasks.exe 1908 schtasks.exe 1100 schtasks.exe 2592 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1668 CMD.exe 1152 schtasks.exe 1908 CMD.exe 2936 schtasks.exe 2440 CMD.exe 2208 schtasks.exe 1332 CMD.exe 1056 schtasks.exe 1516 CMD.exe 1720 schtasks.exe 2428 CMD.exe 2312 schtasks.exe 2352 CMD.exe 1304 schtasks.exe 2988 CMD.exe 2572 schtasks.exe 2568 CMD.exe 3060 schtasks.exe 2124 CMD.exe 2380 schtasks.exe 1396 CMD.exe 2288 schtasks.exe 480 CMD.exe 1976 schtasks.exe 3024 CMD.exe 1680 schtasks.exe 1376 CMD.exe 1104 schtasks.exe 1776 CMD.exe 1852 schtasks.exe 2264 CMD.exe 3012 schtasks.exe 2344 CMD.exe 1580 schtasks.exe 2444 CMD.exe 2676 schtasks.exe 2884 CMD.exe 2596 schtasks.exe 560 CMD.exe 1576 schtasks.exe 2536 CMD.exe 2652 schtasks.exe 2936 CMD.exe 1804 schtasks.exe 2768 CMD.exe 1960 schtasks.exe 2296 CMD.exe 2836 schtasks.exe 1404 CMD.exe 1868 schtasks.exe 1300 CMD.exe 2424 schtasks.exe 1664 CMD.exe 1600 schtasks.exe 2612 CMD.exe 2876 schtasks.exe 1820 CMD.exe 2452 schtasks.exe 1576 CMD.exe 1348 schtasks.exe 552 CMD.exe 2944 schtasks.exe 2432 CMD.exe 2036 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2892 32af824687697346da2d415bfb80fa29.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2872 2892 32af824687697346da2d415bfb80fa29.exe 31 PID 2892 wrote to memory of 2872 2892 32af824687697346da2d415bfb80fa29.exe 31 PID 2892 wrote to memory of 2872 2892 32af824687697346da2d415bfb80fa29.exe 31 PID 2872 wrote to memory of 2592 2872 CMD.exe 33 PID 2872 wrote to memory of 2592 2872 CMD.exe 33 PID 2872 wrote to memory of 2592 2872 CMD.exe 33 PID 2892 wrote to memory of 2596 2892 32af824687697346da2d415bfb80fa29.exe 34 PID 2892 wrote to memory of 2596 2892 32af824687697346da2d415bfb80fa29.exe 34 PID 2892 wrote to memory of 2596 2892 32af824687697346da2d415bfb80fa29.exe 34 PID 2596 wrote to memory of 1672 2596 CMD.exe 36 PID 2596 wrote to memory of 1672 2596 CMD.exe 36 PID 2596 wrote to memory of 1672 2596 CMD.exe 36 PID 2892 wrote to memory of 588 2892 32af824687697346da2d415bfb80fa29.exe 37 PID 2892 wrote to memory of 588 2892 32af824687697346da2d415bfb80fa29.exe 37 PID 2892 wrote to memory of 588 2892 32af824687697346da2d415bfb80fa29.exe 37 PID 588 wrote to memory of 2100 588 CMD.exe 39 PID 588 wrote to memory of 2100 588 CMD.exe 39 PID 588 wrote to memory of 2100 588 CMD.exe 39 PID 2892 wrote to memory of 1668 2892 32af824687697346da2d415bfb80fa29.exe 40 PID 2892 wrote to memory of 1668 2892 32af824687697346da2d415bfb80fa29.exe 40 PID 2892 wrote to memory of 1668 2892 32af824687697346da2d415bfb80fa29.exe 40 PID 1668 wrote to memory of 1152 1668 CMD.exe 42 PID 1668 wrote to memory of 1152 1668 CMD.exe 42 PID 1668 wrote to memory of 1152 1668 CMD.exe 42 PID 2892 wrote to memory of 1908 2892 32af824687697346da2d415bfb80fa29.exe 43 PID 2892 wrote to memory of 1908 2892 32af824687697346da2d415bfb80fa29.exe 43 PID 2892 wrote to memory of 1908 2892 32af824687697346da2d415bfb80fa29.exe 43 PID 1908 wrote to memory of 2936 1908 CMD.exe 45 PID 1908 wrote to memory of 2936 1908 CMD.exe 45 PID 1908 wrote to memory of 2936 1908 CMD.exe 45 PID 2892 wrote to memory of 2440 2892 32af824687697346da2d415bfb80fa29.exe 46 PID 2892 wrote to memory of 2440 2892 32af824687697346da2d415bfb80fa29.exe 46 PID 2892 wrote to memory of 2440 2892 32af824687697346da2d415bfb80fa29.exe 46 PID 2440 wrote to memory of 2208 2440 CMD.exe 48 PID 2440 wrote to memory of 2208 2440 CMD.exe 48 PID 2440 wrote to memory of 2208 2440 CMD.exe 48 PID 2892 wrote to memory of 1332 2892 32af824687697346da2d415bfb80fa29.exe 49 PID 2892 wrote to memory of 1332 2892 32af824687697346da2d415bfb80fa29.exe 49 PID 2892 wrote to memory of 1332 2892 32af824687697346da2d415bfb80fa29.exe 49 PID 1332 wrote to memory of 1056 1332 CMD.exe 51 PID 1332 wrote to memory of 1056 1332 CMD.exe 51 PID 1332 wrote to memory of 1056 1332 CMD.exe 51 PID 2892 wrote to memory of 1516 2892 32af824687697346da2d415bfb80fa29.exe 52 PID 2892 wrote to memory of 1516 2892 32af824687697346da2d415bfb80fa29.exe 52 PID 2892 wrote to memory of 1516 2892 32af824687697346da2d415bfb80fa29.exe 52 PID 1516 wrote to memory of 1720 1516 CMD.exe 54 PID 1516 wrote to memory of 1720 1516 CMD.exe 54 PID 1516 wrote to memory of 1720 1516 CMD.exe 54 PID 2892 wrote to memory of 2428 2892 32af824687697346da2d415bfb80fa29.exe 55 PID 2892 wrote to memory of 2428 2892 32af824687697346da2d415bfb80fa29.exe 55 PID 2892 wrote to memory of 2428 2892 32af824687697346da2d415bfb80fa29.exe 55 PID 2428 wrote to memory of 2312 2428 CMD.exe 57 PID 2428 wrote to memory of 2312 2428 CMD.exe 57 PID 2428 wrote to memory of 2312 2428 CMD.exe 57 PID 2892 wrote to memory of 2352 2892 32af824687697346da2d415bfb80fa29.exe 58 PID 2892 wrote to memory of 2352 2892 32af824687697346da2d415bfb80fa29.exe 58 PID 2892 wrote to memory of 2352 2892 32af824687697346da2d415bfb80fa29.exe 58 PID 2352 wrote to memory of 1304 2352 CMD.exe 60 PID 2352 wrote to memory of 1304 2352 CMD.exe 60 PID 2352 wrote to memory of 1304 2352 CMD.exe 60 PID 2892 wrote to memory of 2988 2892 32af824687697346da2d415bfb80fa29.exe 61 PID 2892 wrote to memory of 2988 2892 32af824687697346da2d415bfb80fa29.exe 61 PID 2892 wrote to memory of 2988 2892 32af824687697346da2d415bfb80fa29.exe 61 PID 2988 wrote to memory of 2572 2988 CMD.exe 63 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe"C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2592
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1672
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2100
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1152
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2936
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1304
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2572
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:3060
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2380
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2288
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:480 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2264 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:3012
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2676
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:560 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2536 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1804
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2836
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1404 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1600
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2876
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1348
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:552 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3036
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:972
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2180
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3032
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2544
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1736
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:996
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:708
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2324
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1300
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2124
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2900
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:3068
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2552
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:764
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1060
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:1396
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1908
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:2236
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:680
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit2⤵PID:908
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1100
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6