Technical Information
- <SYSTEM32>\tasks\nafifas
- %WINDIR%\syswow64\cmd.exe
- %TEMP%\images__1__nox_icon.ico
- %APPDATA%\windows defender\windows defender.exe
- '79.##4.225.90':9757
- '%APPDATA%\windows defender\windows defender.exe'
- '%APPDATA%\windows defender\windows defender.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\windows defender\windows defender.exe'" /f
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\windows defender\windows defender.exe'" /f
- '%WINDIR%\syswow64\cmd.exe' /C copy "<Full path to file>" "%APPDATA%\windows defender\windows defender.exe"
- '<SYSTEM32>\taskeng.exe' {2A1DAD65-1576-422E-B060-C5C4A9AD66BD} S-1-5-21-1960123792-2022915161-3775307078-1001:wnwuxewugzg\user:Interactive:[1]