Technical Information
- <SYSTEM32>\tasks\name
- %TEMP%\folder\file.exe
- %TEMP%\01693ecdc86149859089a7e2b34c7883.xml
- %APPDATA%\remcos\logs.dat
- '72.##.157.241':4445
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\01693ecdc86149859089a7e2b34c7883.xml"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\01693ecdc86149859089a7e2b34c7883.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN name /XML "%TEMP%\01693ecdc86149859089a7e2b34c7883.xml"