Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'test1' = '<Full path to file>'
- <SYSTEM32>\tasks\windows-update
- http://ho##.###-update.com:21001/4iTl via ho##.#60-update.com
- http://ho##.###-update.com:21001/load via ho##.#60-update.com
- DNS ASK ho##.#60-update.com
- '<SYSTEM32>\schtasks.exe' /create /f /tn windows-update /tr <Full path to file> /sc ONLOGON /ru SYSTEM
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "New-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -name test1 -value <Full path to file>"