Technical Information
- <SYSTEM32>\tasks\server
- %TEMP%\server.exe
- <Full path to file>
- '16#.#9.197.142':1414
- '%TEMP%\server.exe'
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn Server /tr %LOCALAPPDATA%\Temp/Server.exe' (with hidden window)
- '%TEMP%\server.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn Server /tr %LOCALAPPDATA%\Temp/Server.exe
- '<SYSTEM32>\taskeng.exe' {003CB500-0641-473C-95E6-731D1B3BFB88} S-1-5-21-1960123792-2022915161-3775307078-1001:pvtfkpx\user:Interactive:[1]