Technical Information
- <SYSTEM32>\tasks\name
- %TEMP%\folder\file.exe
- %TEMP%\3d5b5cf62fb348a1997d8acab32e4735.xml
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK ma##.##00zen1.website
- DNS ASK microsoft.com
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\3d5b5cf62fb348a1997d8acab32e4735.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN name /XML "%TEMP%\3d5b5cf62fb348a1997d8acab32e4735.xml"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '<Full path to file>'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Start-Sleep -Seconds 2; Remove-Item -path '<Full path to file>'