Technical Information
- <SYSTEM32>\tasks\svhost
- %APPDATA%\subdir\svhost.exe
- '27.##.56.186':9782
- '6.#.6.198':9782
- '27.##.56.186':9782
- '%APPDATA%\subdir\svhost.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn "svhost" /sc ONLOGON /tr "<Full path to file>" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svhost" /sc ONLOGON /tr "%APPDATA%\SubDir\svhost.exe" /rl HIGHEST /f