Payouts King Scheduled Task Creation

Ethan Andrews@eandrews

•updated Jun 5, 2026•1•0•4

Identifies the creation, execution, or deletion of specific scheduled tasks ('\Mozilla\ElevateTask' or '\Mozilla\UpdateTask') used by Payouts King ransomware for persistence and SYSTEM elevation.