Persistence via scheduled task
Named by 3 kept items in this workspace.
Search every workspace for Persistence via scheduled task. It matches the name as written, so it can find other things that share it.
The items that name it 3
Scheduled task created to trigger NetSupport client execution at user logon
DockerDesktop.exe written to disk and scheduled to run repeatedly to reinfect the computer.
Added a scheduled task that pinged the attacker's server every 30 minutes as a way back in.
All techniques in this workspace.