Technical Information
- <SYSTEM32>\tasks\windows\diskcleanup\silentcleanup
- %APPDATA%\microsoft\winlog.exe
- %WINDIR%\temp\covid.exe
- 'co###avirus.app':443
- DNS ASK co###avirus.app
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\temp\covid.exe'
- '%APPDATA%\microsoft\winlog.exe'
- '%APPDATA%\microsoft\winlog.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /CREATE /TN \Windows\DiskCleanUp\SilentCleanup /TR "%APPDATA%\microsoft\winlog.exe" /SC MINUTE /F /RL HIGHEST
- '<SYSTEM32>\schtasks.exe' /CREATE /TN \Windows\DiskCleanUp\SilentCleanup /TR "%APPDATA%\microsoft\winlog.exe" /SC MINUTE /F /RL HIGHEST
- '<SYSTEM32>\taskeng.exe' {86CF30C1-9B5D-4E2F-9842-FCD243AB6983} S-1-5-21-1960123792-2022915161-3775307078-1001:sklgiju\user:Interactive:[1]
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\dw20.exe' -x -s 424