Technical Information
- <SYSTEM32>\tasks\name
- %TEMP%\folder\file.exe
- %TEMP%\d62d57f76a8540fab826e8cc40a72ae0.xml
- %APPDATA%\remcos\logs.dat
- '45.##7.22.52':8780
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\d62d57f76a8540fab826e8cc40a72ae0.xml"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\d62d57f76a8540fab826e8cc40a72ae0.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN name /XML "%TEMP%\d62d57f76a8540fab826e8cc40a72ae0.xml"