Technical Information
- <SYSTEM32>\tasks\name
- %TEMP%\folder\file.exe
- %TEMP%\2e7933cd4c36479e897d47cded967c74.xml
- %APPDATA%\remcos\logs.dat
- '72.##.157.241':4445
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\2e7933cd4c36479e897d47cded967c74.xml"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cls
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\2e7933cd4c36479e897d47cded967c74.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN name /XML "%TEMP%\2e7933cd4c36479e897d47cded967c74.xml"