Technical Information
- <SYSTEM32>\tasks\wasa
- %PROGRAMDATA%\updata\filesys32.exe
- 'localhost':5
- '%PROGRAMDATA%\updata\filesys32.exe'
- '%PROGRAMDATA%\updata\filesys32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /SC MINUTE /MO 2 /tn wasa /tr '%ProgramData%\updata\FileSys32.exe' /ec system
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 2 /tn wasa /tr '%PROGRAMDATA%\updata\FileSys32.exe' /ec system
- '<SYSTEM32>\taskeng.exe' {E73B2736-1374-45F5-ACFD-751B0BAB2ED8} S-1-5-21-1960123792-2022915161-3775307078-1001:lxfmeo\user:Interactive:[1]