Technical Information
- <SYSTEM32>\tasks\<File name>.exe
- '5.##.64.33':80
- http://5.##.64.33/vu3skClDn/index.php
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN <File name>.exe /TR "<Full path to file>" /F' (with hidden window)
- '<Full path to file>' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN <File name>.exe /TR "<Full path to file>" /F
- '<SYSTEM32>\taskeng.exe' {8E83C976-F6EE-40EC-BAF3-285F75FB0230} S-1-5-21-1238866942-1249195528-555854008-1000:wwgehoy\user:Interactive:[1]