Technical Information
- <SYSTEM32>\tasks\runtime broker
- %APPDATA%\microsoft\speech\files\userlexicons\sp_0fb59148676041d3880b50942e5277b1.exe
- 'he####ude.ddns.net':6606
- DNS ASK he####ude.ddns.net
- '%APPDATA%\microsoft\speech\files\userlexicons\sp_0fb59148676041d3880b50942e5277b1.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn "Runtime Broker" /sc ONLOGON /tr "<Full path to file>" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Runtime Broker" /sc ONLOGON /tr "%APPDATA%\Microsoft\Speech\Files\UserLexicons\SP_0FB59148676041D3880B50942E5277B1.exe" /rl HIGHEST /f