Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'MyDocuments' = 'C:\Users\Public\Documents\WriteDocuments.exe //b C:\Users\Public\WriteDocuments.vbs'
- <SYSTEM32>\tasks\printsoftware
- <SYSTEM32>\tasks\printwrite
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 15 /F /tn PrintSoftware /tr "C:\Users\Public\Documents\WriteDocuments.exe //b C:\Users\Public\WriteDocuments.vbs"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 8 /F /tn PrintWrite /tr "C:\Users\Public\Documents\intercourse.exe"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 15 /F /tn PrintSoftware /tr "C:\Users\Public\Documents\WriteDocuments.exe //b C:\Users\Public\WriteDocuments.vbs"
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 8 /F /tn PrintWrite /tr "C:\Users\Public\Documents\intercourse.exe"