Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MediaSVC' = 'C:\Users\Public\videos\bat2\mon_main_1.vbs'
- C:\users\public\videos\bat2\config.json
- C:\users\public\videos\bat2\install.bat
- C:\users\public\videos\bat2\mon_main_1.vbs
- C:\users\public\videos\bat2\replace.bat
- C:\users\public\videos\bat2\replace.vbs
- C:\users\public\videos\bat2\run.bat
- C:\users\public\videos\bat2\wmlprvse.exe
- C:\users\public\videos\bat2\install.bat
- C:\users\public\videos\bat2\mon_main_1.vbs
- C:\users\public\videos\bat2\replace.bat
- C:\users\public\videos\bat2\replace.vbs
- C:\users\public\videos\bat2\run.bat
- ClassName: 'EDIT' WindowName: ''
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\videos\bat2\mon_main_1.vbs"
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\videos\bat2\run.bat" "
- '<SYSTEM32>\reg.exe' Add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MediaSVC" /t REG_SZ /d "C:\Users\Public\videos\bat2\mon_main_1.vbs" /f
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\videos\bat2\replace.bat" "
- '<SYSTEM32>\cscript.exe' replace.vbs "mon_main_1.vbs" "$path$" "dsrtsdrt"