Technical Information
- %APPDATA%\xqgkecchz.exe
- %TEMP%\tmpb605.tmp
- %APPDATA%\xqgkecchz.exe
- %TEMP%\tmpb605.tmp
- '79.##4.225.36':4044
- '79.##4.225.36':4044
- '<SYSTEM32>\schtasks.exe' /Create /TN "Updates\XQgKECCHz" /XML "%TEMP%\tmpB605.tmp"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /TN "Updates\XQgKECCHz" /XML "%TEMP%\tmpB605.tmp"