Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\javav1] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\javav1] 'ImagePath' = 'C:\Python37\include\internal\nssm.exe'
Creates the following services
- 'javav1' C:\Python37\include\internal\nssm.exe
Modifies file system
Creates the following files
- C:\python37\include\internal\2.bat
- C:\python37\include\internal\config.json
- C:\python37\include\internal\javav.exe
- C:\python37\include\internal\nssm.exe
- C:\python37\include\internal\winring0x64.sys
Sets the 'hidden' attribute to the following files
- C:\python37\include\internal\2.bat
- C:\python37\include\internal\config.json
- C:\python37\include\internal\nssm.exe
- C:\python37\include\internal\winring0x64.sys
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\python37\include\internal\nssm.exe' install javav1 C:\Python37\include\internal\javav.exe
- 'C:\python37\include\internal\nssm.exe'
- 'C:\python37\include\internal\javav.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Python37\include\internal\2.bat" "
- '%WINDIR%\syswow64\net.exe' start javav1
- '%WINDIR%\syswow64\net1.exe' start javav1