Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{28377E3D-D0AB-DD4A-0706-030805000603}] 'StubPath' = '<SYSTEM32>\safe32.ExE'
- %WINDIR%\Temp\201184215352.exe
- %WINDIR%\Temp\201184215350.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\safe32.ExE
- %WINDIR%\Temp\201184215352.exe
- %WINDIR%\Temp\201184215350.exe
- 'ne###.3322.org':8115
- DNS ASK ne###.3322.org
- ClassName: 'shell_traywnd' WindowName: ''