Svchost.rar -

: Check for related malicious processes or scheduled tasks that may have been established after the archive was extracted.

: After the internal tools are deployed, the command del /f /q svchost.rar is often issued to remove forensic traces. svchost.rar

: The actor uses the command tar -xvf svchost.rar to extract post-compromise tools. : Check for related malicious processes or scheduled