Technical Information
- <SYSTEM32>\tasks\name
- %TEMP%\folder\file.exe
- %TEMP%\3bc9d0e4991c4127854c846f1c363314.xml
- 'ma##.###kaykalibrasyon.com':587
- DNS ASK ma##.###kaykalibrasyon.com
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\3bc9d0e4991c4127854c846f1c363314.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN name /XML "%TEMP%\3bc9d0e4991c4127854c846f1c363314.xml"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '<Full path to file>'