Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vlc' = '"%APPDATA%\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'
- <SYSTEM32>\tasks\task
- task.exe
- %APPDATA%\microsoft\windows\start menu\programs\videolan\vlc.exe
- %APPDATA%\task.exe
- %TEMP%\tmp8989.tmp.bat
- nul
- 'fi#####arm.duckdns.org':6606
- DNS ASK fi#####arm.duckdns.org
- '%APPDATA%\task.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "task" /tr '"%APPDATA%\task.exe"' & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "task" /tr '"%APPDATA%\task.exe"' & exit
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc onlogon /rl highest /tn "task" /tr '"%APPDATA%\task.exe"'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp8989.tmp.bat""
- '%WINDIR%\syswow64\timeout.exe' 3