Technical Information
- <SYSTEM32>\tasks\updates\nktdcniq
- '' (downloaded from the Internet)
- '%APPDATA%\endsa.exe'
- %APPDATA%\endsa.exe
- %APPDATA%\nktdcniq.exe
- %TEMP%\tmpc541.tmp
- %APPDATA%\nktdcniq.exe
- %TEMP%\tmpc541.tmp
- 'as####lavours.in':80
- DNS ASK as####lavours.in
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\NkTdCNIq" /XML "%TEMP%\tmpC541.tmp"' (with hidden window)
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\NkTdCNIq" /XML "%TEMP%\tmpC541.tmp"