Technical Information
- <SYSTEM32>\tasks\runtime broker
- %ProgramFiles%\windows security\runtimebroker.exe
- <Full path to file>
- %ProgramFiles%\windows security\runtimebroker.exe
- '12#.#89.160.201':4774
- '%ProgramFiles%\windows security\runtimebroker.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn "Runtime Broker" /sc ONLOGON /tr "<Full path to file>" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Runtime Broker" /sc ONLOGON /tr "%ProgramFiles%\Windows Security\RuntimeBroker.exe" /rl HIGHEST /f