Technical Information
- <SYSTEM32>\tasks\apprunrm
- %APPDATA%\20191002\fbbrzols.vbs
- '<SYSTEM32>\cmd.exe' /C schtasks /F /create /sc hourly /mo 8 /TN "AppRunRM" /ST 07:00 /TR "%APPDATA%\20191002\fBbrZOls.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C schtasks /F /create /sc hourly /mo 8 /TN "AppRunRM" /ST 07:00 /TR "%APPDATA%\20191002\fBbrZOls.vbs"
- '<SYSTEM32>\schtasks.exe' /F /create /sc hourly /mo 8 /TN "AppRunRM" /ST 07:00 /TR "%APPDATA%\20191002\fBbrZOls.vbs"