It does this via cmd.exe with the following command:   move /Y  "{malware_location}"  "C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdrive.exe"  Every time the malware runs a command using cmd.exe, the standard output (STDOUT) of the executed command is piped and written to a Google Drive account with the following filename format:   {utcnow}_report_{victim’s id}       Figure 6.