Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdate' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.vbs
- <SYSTEM32>\tasks\windowsupdatetask
Modifies file system
Creates the following files
- %TEMP%\_mei20762\pil\avifimageplugin.py
- %TEMP%\_mei20762\pil\bdffontfile.py
- %TEMP%\_mei20762\pil\blpimageplugin.py
- %TEMP%\_mei20762\pil\bmpimageplugin.py
- %TEMP%\_mei20762\pil\bufrstubimageplugin.py
- %TEMP%\_mei20762\pil\containerio.py
- %TEMP%\_mei20762\pil\curimageplugin.py
- %TEMP%\_mei20762\pil\dcximageplugin.py
- %TEMP%\_mei20762\pil\ddsimageplugin.py
- %TEMP%\_mei20762\pil\epsimageplugin.py
- %TEMP%\_mei20762\pil\exiftags.py
- %TEMP%\_mei20762\pil\fitsimageplugin.py
- %TEMP%\_mei20762\pil\fliimageplugin.py
- %TEMP%\_mei20762\pil\fontfile.py
- %TEMP%\_mei20762\pil\fpximageplugin.py
- %TEMP%\_mei20762\pil\fteximageplugin.py
- %TEMP%\_mei20762\pil\gbrimageplugin.py
- %TEMP%\_mei20762\pil\gdimagefile.py
- %TEMP%\_mei20762\pil\gifimageplugin.py
- %TEMP%\_mei20762\pil\gimpgradientfile.py
- %TEMP%\_mei20762\pil\gimppalettefile.py
- %TEMP%\_mei20762\pil\gribstubimageplugin.py
- %TEMP%\_mei20762\pil\hdf5stubimageplugin.py
- %TEMP%\_mei20762\pil\icnsimageplugin.py
- %TEMP%\_mei20762\pil\icoimageplugin.py
- %TEMP%\_mei20762\pil\imimageplugin.py
- %TEMP%\_mei20762\pil\image.py
- %TEMP%\_mei20762\pil\imagechops.py
- %TEMP%\_mei20762\pil\imagecms.py
- %TEMP%\_mei20762\pil\imagecolor.py
- %TEMP%\_mei20762\pil\imagedraw.py
- %TEMP%\_mei20762\pil\imagedraw2.py
- %TEMP%\_mei20762\pil\imageenhance.py
- %TEMP%\_mei20762\pil\imagefile.py
- %TEMP%\_mei20762\pil\imagefilter.py
- %TEMP%\_mei20762\pil\imagefont.py
- %TEMP%\_mei20762\pil\imagegrab.py
- %TEMP%\_mei20762\pil\imagemath.py
- %TEMP%\_mei20762\pil\imagemode.py
- %TEMP%\_mei20762\pil\imagemorph.py
- %TEMP%\_mei20762\pil\imageops.py
- %TEMP%\_mei20762\pil\imagepalette.py
- %TEMP%\_mei20762\pil\imagepath.py
- %TEMP%\_mei20762\pil\imageqt.py
- %TEMP%\_mei20762\pil\imagesequence.py
- %TEMP%\_mei20762\pil\imageshow.py
- %TEMP%\_mei20762\pil\imagestat.py
- %TEMP%\_mei20762\pil\imagetext.py
- %TEMP%\_mei20762\pil\imagetk.py
- %TEMP%\_mei20762\pil\imagetransform.py
- %TEMP%\_mei20762\pil\imagewin.py
- %TEMP%\_mei20762\pil\imtimageplugin.py
- %TEMP%\_mei20762\pil\iptcimageplugin.py
- %TEMP%\_mei20762\pil\jpeg2kimageplugin.py
- %TEMP%\_mei20762\pil\jpegimageplugin.py
- %TEMP%\_mei20762\pil\jpegpresets.py
- %TEMP%\_mei20762\pil\mcidasimageplugin.py
- %TEMP%\_mei20762\pil\micimageplugin.py
- %TEMP%\_mei20762\pil\mpegimageplugin.py
- %TEMP%\_mei20762\pil\mpoimageplugin.py
- %TEMP%\_mei20762\pil\mspimageplugin.py
- %TEMP%\_mei20762\pil\psdraw.py
- %TEMP%\_mei20762\pil\palettefile.py
- %TEMP%\_mei20762\pil\palmimageplugin.py
- %TEMP%\_mei20762\pil\pcdimageplugin.py
- %TEMP%\_mei20762\pil\pcffontfile.py
- %TEMP%\_mei20762\pil\pcximageplugin.py
- %TEMP%\_mei20762\pil\pdfimageplugin.py
- %TEMP%\_mei20762\pil\pdfparser.py
- %TEMP%\_mei20762\pil\pixarimageplugin.py
- %TEMP%\_mei20762\pil\pngimageplugin.py
- %TEMP%\_mei20762\pil\ppmimageplugin.py
- %TEMP%\_mei20762\pil\psdimageplugin.py
- %TEMP%\_mei20762\pil\qoiimageplugin.py
- %TEMP%\_mei20762\pil\sgiimageplugin.py
- %TEMP%\_mei20762\pil\spiderimageplugin.py
- %TEMP%\_mei20762\pil\sunimageplugin.py
- %TEMP%\_mei20762\pil\tario.py
- %TEMP%\_mei20762\pil\tgaimageplugin.py
- %TEMP%\_mei20762\pil\tiffimageplugin.py
- %TEMP%\_mei20762\pil\tifftags.py
- %TEMP%\_mei20762\pil\walimagefile.py
- %TEMP%\_mei20762\pil\webpimageplugin.py
- %TEMP%\_mei20762\pil\wmfimageplugin.py
- %TEMP%\_mei20762\pil\xvthumbimageplugin.py
- %TEMP%\_mei20762\pil\xbmimageplugin.py
- %TEMP%\_mei20762\pil\xpmimageplugin.py
- %TEMP%\_mei20762\pil\__init__.py
- %TEMP%\_mei20762\pil\__main__.py
- %TEMP%\_mei20762\pil\_avif.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_avif.pyi
- %TEMP%\_mei20762\pil\_binary.py
- %TEMP%\_mei20762\pil\_deprecate.py
- %TEMP%\_mei20762\pil\_imaging.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imaging.pyi
- %TEMP%\_mei20762\pil\_imagingcms.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingcms.pyi
- %TEMP%\_mei20762\pil\_imagingft.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingft.pyi
- %TEMP%\_mei20762\pil\_imagingmath.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingmath.pyi
- %TEMP%\_mei20762\pil\_imagingmorph.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingmorph.pyi
- %TEMP%\_mei20762\pil\_imagingtk.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingtk.pyi
- %TEMP%\_mei20762\pil\_tkinter_finder.py
- %TEMP%\_mei20762\pil\_typing.py
- %TEMP%\_mei20762\pil\_util.py
- %TEMP%\_mei20762\pil\_version.py
- %TEMP%\_mei20762\pil\_webp.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_webp.pyi
- %TEMP%\_mei20762\pil\features.py
- %TEMP%\_mei20762\pil\report.py
- %TEMP%\_mei20762\vcruntime140.dll
- %TEMP%\_mei20762\_asyncio.pyd
- %TEMP%\_mei20762\_bz2.pyd
- %TEMP%\_mei20762\_cffi_backend.cp310-win_amd64.pyd
- %TEMP%\_mei20762\_ctypes.pyd
- %TEMP%\_mei20762\_decimal.pyd
- %TEMP%\_mei20762\_elementtree.pyd
- %TEMP%\_mei20762\_hashlib.pyd
- %TEMP%\_mei20762\_lzma.pyd
- %TEMP%\_mei20762\_multiprocessing.pyd
- %TEMP%\_mei20762\_overlapped.pyd
- %TEMP%\_mei20762\_queue.pyd
- %TEMP%\_mei20762\_socket.pyd
- %TEMP%\_mei20762\_sqlite3.pyd
- %TEMP%\_mei20762\_ssl.pyd
- %TEMP%\_mei20762\base_library.zip
- %TEMP%\_mei20762\bcrypt\_bcrypt.pyd
- %TEMP%\_mei20762\certifi\cacert.pem
- %TEMP%\_mei20762\charset_normalizer\md.cp310-win_amd64.pyd
- %TEMP%\_mei20762\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei20762\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei20762\libcrypto-1_1.dll
- %TEMP%\_mei20762\libffi-7.dll
- %TEMP%\_mei20762\libssl-1_1.dll
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\installer
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\metadata
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\record
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\wheel
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\licenses\license
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\top_level.txt
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\zip-safe
- %TEMP%\_mei20762\pyexpat.pyd
- %TEMP%\_mei20762\python3.dll
- %TEMP%\_mei20762\python310.dll
- %TEMP%\_mei20762\requests-2.32.5.dist-info\installer
- %TEMP%\_mei20762\requests-2.32.5.dist-info\metadata
- %TEMP%\_mei20762\requests-2.32.5.dist-info\record
- %TEMP%\_mei20762\requests-2.32.5.dist-info\wheel
- %TEMP%\_mei20762\requests-2.32.5.dist-info\licenses\license
- %TEMP%\_mei20762\requests-2.32.5.dist-info\top_level.txt
- %TEMP%\_mei20762\requests\__init__.py
- %TEMP%\_mei20762\requests\__version__.py
- %TEMP%\_mei20762\requests\_internal_utils.py
- %TEMP%\_mei20762\requests\adapters.py
- %TEMP%\_mei20762\requests\api.py
- %TEMP%\_mei20762\requests\auth.py
- %TEMP%\_mei20762\requests\certs.py
- %TEMP%\_mei20762\requests\compat.py
- %TEMP%\_mei20762\requests\cookies.py
- %TEMP%\_mei20762\requests\exceptions.py
- %TEMP%\_mei20762\requests\help.py
- %TEMP%\_mei20762\requests\hooks.py
- %TEMP%\_mei20762\requests\models.py
- %TEMP%\_mei20762\requests\packages.py
- %TEMP%\_mei20762\requests\sessions.py
- %TEMP%\_mei20762\requests\status_codes.py
- %TEMP%\_mei20762\requests\structures.py
- %TEMP%\_mei20762\requests\utils.py
- %TEMP%\_mei20762\select.pyd
- %TEMP%\_mei20762\sqlite3.dll
- %TEMP%\_mei20762\unicodedata.pyd
- %TEMP%\_mei20762\zstandard\_cffi.cp310-win_amd64.pyd
- %TEMP%\_mei20762\zstandard\backend_c.cp310-win_amd64.pyd
Deletes following files that it created itself
- %TEMP%\_mei20762\base_library.zip
- %TEMP%\_mei20762\bcrypt\_bcrypt.pyd
- %TEMP%\_mei20762\certifi\cacert.pem
- %TEMP%\_mei20762\charset_normalizer\md.cp310-win_amd64.pyd
- %TEMP%\_mei20762\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
- %TEMP%\_mei20762\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei20762\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei20762\libcrypto-1_1.dll
- %TEMP%\_mei20762\libffi-7.dll
- %TEMP%\_mei20762\libssl-1_1.dll
- %TEMP%\_mei20762\pil\avifimageplugin.py
- %TEMP%\_mei20762\pil\bdffontfile.py
- %TEMP%\_mei20762\pil\blpimageplugin.py
- %TEMP%\_mei20762\pil\bmpimageplugin.py
- %TEMP%\_mei20762\pil\bufrstubimageplugin.py
- %TEMP%\_mei20762\pil\containerio.py
- %TEMP%\_mei20762\pil\curimageplugin.py
- %TEMP%\_mei20762\pil\dcximageplugin.py
- %TEMP%\_mei20762\pil\ddsimageplugin.py
- %TEMP%\_mei20762\pil\epsimageplugin.py
- %TEMP%\_mei20762\pil\exiftags.py
- %TEMP%\_mei20762\pil\features.py
- %TEMP%\_mei20762\pil\fitsimageplugin.py
- %TEMP%\_mei20762\pil\fliimageplugin.py
- %TEMP%\_mei20762\pil\fontfile.py
- %TEMP%\_mei20762\pil\fpximageplugin.py
- %TEMP%\_mei20762\pil\fteximageplugin.py
- %TEMP%\_mei20762\pil\gbrimageplugin.py
- %TEMP%\_mei20762\pil\gdimagefile.py
- %TEMP%\_mei20762\pil\gifimageplugin.py
- %TEMP%\_mei20762\pil\gimpgradientfile.py
- %TEMP%\_mei20762\pil\gimppalettefile.py
- %TEMP%\_mei20762\pil\gribstubimageplugin.py
- %TEMP%\_mei20762\pil\hdf5stubimageplugin.py
- %TEMP%\_mei20762\pil\icnsimageplugin.py
- %TEMP%\_mei20762\pil\icoimageplugin.py
- %TEMP%\_mei20762\pil\image.py
- %TEMP%\_mei20762\pil\imagechops.py
- %TEMP%\_mei20762\pil\imagecms.py
- %TEMP%\_mei20762\pil\imagecolor.py
- %TEMP%\_mei20762\pil\imagedraw.py
- %TEMP%\_mei20762\pil\imagedraw2.py
- %TEMP%\_mei20762\pil\imageenhance.py
- %TEMP%\_mei20762\pil\imagefile.py
- %TEMP%\_mei20762\pil\imagefilter.py
- %TEMP%\_mei20762\pil\imagefont.py
- %TEMP%\_mei20762\pil\imagegrab.py
- %TEMP%\_mei20762\pil\imagemath.py
- %TEMP%\_mei20762\pil\imagemode.py
- %TEMP%\_mei20762\pil\imagemorph.py
- %TEMP%\_mei20762\pil\imageops.py
- %TEMP%\_mei20762\pil\imagepalette.py
- %TEMP%\_mei20762\pil\imagepath.py
- %TEMP%\_mei20762\pil\imageqt.py
- %TEMP%\_mei20762\pil\imagesequence.py
- %TEMP%\_mei20762\pil\imageshow.py
- %TEMP%\_mei20762\pil\imagestat.py
- %TEMP%\_mei20762\pil\imagetext.py
- %TEMP%\_mei20762\pil\imagetk.py
- %TEMP%\_mei20762\pil\imagetransform.py
- %TEMP%\_mei20762\pil\imagewin.py
- %TEMP%\_mei20762\pil\imimageplugin.py
- %TEMP%\_mei20762\pil\imtimageplugin.py
- %TEMP%\_mei20762\pil\iptcimageplugin.py
- %TEMP%\_mei20762\pil\jpeg2kimageplugin.py
- %TEMP%\_mei20762\pil\jpegimageplugin.py
- %TEMP%\_mei20762\pil\jpegpresets.py
- %TEMP%\_mei20762\pil\mcidasimageplugin.py
- %TEMP%\_mei20762\pil\micimageplugin.py
- %TEMP%\_mei20762\pil\mpegimageplugin.py
- %TEMP%\_mei20762\pil\mpoimageplugin.py
- %TEMP%\_mei20762\pil\mspimageplugin.py
- %TEMP%\_mei20762\pil\palettefile.py
- %TEMP%\_mei20762\pil\palmimageplugin.py
- %TEMP%\_mei20762\pil\pcdimageplugin.py
- %TEMP%\_mei20762\pil\pcffontfile.py
- %TEMP%\_mei20762\pil\pcximageplugin.py
- %TEMP%\_mei20762\pil\pdfimageplugin.py
- %TEMP%\_mei20762\pil\pdfparser.py
- %TEMP%\_mei20762\pil\pixarimageplugin.py
- %TEMP%\_mei20762\pil\pngimageplugin.py
- %TEMP%\_mei20762\pil\ppmimageplugin.py
- %TEMP%\_mei20762\pil\psdimageplugin.py
- %TEMP%\_mei20762\pil\psdraw.py
- %TEMP%\_mei20762\pil\qoiimageplugin.py
- %TEMP%\_mei20762\pil\report.py
- %TEMP%\_mei20762\pil\sgiimageplugin.py
- %TEMP%\_mei20762\pil\spiderimageplugin.py
- %TEMP%\_mei20762\pil\sunimageplugin.py
- %TEMP%\_mei20762\pil\tario.py
- %TEMP%\_mei20762\pil\tgaimageplugin.py
- %TEMP%\_mei20762\pil\tiffimageplugin.py
- %TEMP%\_mei20762\pil\tifftags.py
- %TEMP%\_mei20762\pil\walimagefile.py
- %TEMP%\_mei20762\pil\webpimageplugin.py
- %TEMP%\_mei20762\pil\wmfimageplugin.py
- %TEMP%\_mei20762\pil\xbmimageplugin.py
- %TEMP%\_mei20762\pil\xpmimageplugin.py
- %TEMP%\_mei20762\pil\xvthumbimageplugin.py
- %TEMP%\_mei20762\pil\_avif.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_avif.pyi
- %TEMP%\_mei20762\pil\_binary.py
- %TEMP%\_mei20762\pil\_deprecate.py
- %TEMP%\_mei20762\pil\_imaging.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imaging.pyi
- %TEMP%\_mei20762\pil\_imagingcms.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingcms.pyi
- %TEMP%\_mei20762\pil\_imagingft.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingft.pyi
- %TEMP%\_mei20762\pil\_imagingmath.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingmath.pyi
- %TEMP%\_mei20762\pil\_imagingmorph.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingmorph.pyi
- %TEMP%\_mei20762\pil\_imagingtk.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_imagingtk.pyi
- %TEMP%\_mei20762\pil\_tkinter_finder.py
- %TEMP%\_mei20762\pil\_typing.py
- %TEMP%\_mei20762\pil\_util.py
- %TEMP%\_mei20762\pil\_version.py
- %TEMP%\_mei20762\pil\_webp.cp310-win_amd64.pyd
- %TEMP%\_mei20762\pil\_webp.pyi
- %TEMP%\_mei20762\pil\__init__.py
- %TEMP%\_mei20762\pil\__main__.py
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\installer
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\licenses\license
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\metadata
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\record
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\top_level.txt
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\wheel
- %TEMP%\_mei20762\pillow-12.0.0.dist-info\zip-safe
- %TEMP%\_mei20762\pyexpat.pyd
- %TEMP%\_mei20762\python3.dll
- %TEMP%\_mei20762\python310.dll
- %TEMP%\_mei20762\requests\adapters.py
- %TEMP%\_mei20762\requests\api.py
- %TEMP%\_mei20762\requests\auth.py
- %TEMP%\_mei20762\requests\certs.py
- %TEMP%\_mei20762\requests\compat.py
- %TEMP%\_mei20762\requests\cookies.py
- %TEMP%\_mei20762\requests\exceptions.py
- %TEMP%\_mei20762\requests\help.py
- %TEMP%\_mei20762\requests\hooks.py
- %TEMP%\_mei20762\requests\models.py
- %TEMP%\_mei20762\requests\packages.py
- %TEMP%\_mei20762\requests\sessions.py
- %TEMP%\_mei20762\requests\status_codes.py
- %TEMP%\_mei20762\requests\structures.py
- %TEMP%\_mei20762\requests\utils.py
- %TEMP%\_mei20762\requests\_internal_utils.py
- %TEMP%\_mei20762\requests\__init__.py
- %TEMP%\_mei20762\requests\__version__.py
- %TEMP%\_mei20762\requests-2.32.5.dist-info\installer
- %TEMP%\_mei20762\requests-2.32.5.dist-info\licenses\license
- %TEMP%\_mei20762\requests-2.32.5.dist-info\metadata
- %TEMP%\_mei20762\requests-2.32.5.dist-info\record
- %TEMP%\_mei20762\requests-2.32.5.dist-info\top_level.txt
- %TEMP%\_mei20762\requests-2.32.5.dist-info\wheel
- %TEMP%\_mei20762\select.pyd
- %TEMP%\_mei20762\sqlite3.dll
- %TEMP%\_mei20762\unicodedata.pyd
- %TEMP%\_mei20762\vcruntime140.dll
- %TEMP%\_mei20762\zstandard\backend_c.cp310-win_amd64.pyd
- %TEMP%\_mei20762\zstandard\_cffi.cp310-win_amd64.pyd
- %TEMP%\_mei20762\_asyncio.pyd
- %TEMP%\_mei20762\_bz2.pyd
- %TEMP%\_mei20762\_cffi_backend.cp310-win_amd64.pyd
- %TEMP%\_mei20762\_ctypes.pyd
- %TEMP%\_mei20762\_decimal.pyd
- %TEMP%\_mei20762\_elementtree.pyd
- %TEMP%\_mei20762\_hashlib.pyd
- %TEMP%\_mei20762\_lzma.pyd
- %TEMP%\_mei20762\_multiprocessing.pyd
- %TEMP%\_mei20762\_overlapped.pyd
- %TEMP%\_mei20762\_queue.pyd
- %TEMP%\_mei20762\_socket.pyd
- %TEMP%\_mei20762\_sqlite3.pyd
- %TEMP%\_mei20762\_ssl.pyd
Network activity
Connects to
- 'ap#.#yip.com':443
- 'di##ord.com':443
TCP
Other
- 'ap#.#yip.com':443
- 'di##ord.com':443
UDP
- DNS ASK ap#.#yip.com
- DNS ASK di##ord.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsUpdateTask /tr <Full path to file> /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist"' (with hidden window)
