Technical Information
- <SYSTEM32>\tasks\<File name>.exe
- '45.#.74.5':80
- http://45.#.74.5/b7djSDcPcZ/index.php
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN <File name>.exe /TR "<Full path to file>" /F' (with hidden window)
- '<Full path to file>' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN <File name>.exe /TR "<Full path to file>" /F
- '<SYSTEM32>\taskeng.exe' {7A1DC712-7B42-493F-B80F-F48B94EEA038} S-1-5-21-1238866942-1249195528-555854008-1000:tkilsdy\user:Interactive:[1]