Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Services' = '%APPDATA%\Windows Update Folder\Windows Update.exe'
- <SYSTEM32>\tasks\usermode font driver host
- usermode font driver host.exe
- %APPDATA%\windows update folder\windows update.exe
- %APPDATA%\usermode font driver host.exe
- %TEMP%\tmp8362.tmp.bat
- nul
- 'localhost':7707
- 'su#######wledgebase.ddns.net':8808
- 'su#######wledgebase.ddns.net':86
- DNS ASK su#######wledgebase.ddns.net
- '%APPDATA%\usermode font driver host.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Usermode Font Driver Host" /tr '"%APPDATA%\Usermode Font Driver Host.exe"' & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Usermode Font Driver Host" /tr '"%APPDATA%\Usermode Font Driver Host.exe"' & exit
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc onlogon /rl highest /tn "Usermode Font Driver Host" /tr '"%APPDATA%\Usermode Font Driver Host.exe"'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp8362.tmp.bat""
- '%WINDIR%\syswow64\timeout.exe' 3