Technical Information
- <SYSTEM32>\tasks\<File name>.exe
- '45.#.74.5':80
- http://45.#.74.5/b7djSDcPcZ/index.php
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN <File name>.exe /TR "<Full path to file>" /F' (with hidden window)
- '<Full path to file>' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN <File name>.exe /TR "<Full path to file>" /F
- '<SYSTEM32>\taskeng.exe' {8E1870BB-B49C-4D98-9E18-156238AC736C} S-1-5-21-1238866942-1249195528-555854008-1000:lxcvnihv\user:Interactive:[1]