Technical Information
- <SYSTEM32>\tasks\winmanager
- %HOMEPATH%\documents\chegg\chegg_free_awnsers.exe
- %TEMP%\newtask.xml
- %HOMEPATH%\documents\chegg\rcx2b82.tmp
- %HOMEPATH%\documents\chegg\chegg_free_awnsers.exe
- %TEMP%\newtask.xml
- from %HOMEPATH%\documents\chegg\rcx2b82.tmp to %HOMEPATH%\documents\chegg\chegg_free_awnsers.exe
- DNS ASK gi####rdkings.co
- '%HOMEPATH%\documents\chegg\chegg_free_awnsers.exe' /wait
- '%HOMEPATH%\documents\chegg\chegg_free_awnsers.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "WinManager" /XML "%TEMP%\NewTask.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Query /FO "LIST" /TN "WinManager"
- '<SYSTEM32>\taskeng.exe' {C7F527F4-3877-4C3D-B964-28299FF80DA5} S-1-5-21-3691498038-2086406363-2140527554-1000:ritttfa\user:Interactive:[1]
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "WinManager" /XML "%TEMP%\NewTask.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Query /FO "LIST" /TN "WinManager"' (with hidden window)
- '%HOMEPATH%\documents\chegg\chegg_free_awnsers.exe' ' (with hidden window)