Technical Information
- <SYSTEM32>\tasks\xcsd
- %TEMP%\xcsv\xcdv.exe
- %TEMP%\e9decff07c6e41309188eb505b02ae37.xml
- 'en####1.gotdns.ch':51817
- DNS ASK en####1.gotdns.ch
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN xcsd /XML "%TEMP%\e9decff07c6e41309188eb505b02ae37.xml"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN xcsd /XML "%TEMP%\e9decff07c6e41309188eb505b02ae37.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN xcsd /XML "%TEMP%\e9decff07c6e41309188eb505b02ae37.xml"