value:  APT32 has used scheduled task raw XML with a backdated timestamp of June 2 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally APT32 has used a random value to modify the timestamp of the file storing the clientID. 
name: Indicator Removal on Host: Timestomp