Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '<LS_APPDATA>\dwnsys.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Winlogon Services' = '<LS_APPDATA>\_xx_svchost.exe'
- <LS_APPDATA>\dwnsys.exe (downloaded from the Internet)
- <LS_APPDATA>\_xx_svchost.exe
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\dwnsys.exe
- <LS_APPDATA>\_xx_svchost.exe
- %TEMP%\lsass.exe
- <LS_APPDATA>\dwnsys.exe
- 'en#######nternet.fileave.com':80
- 'tr#####rhost.dyndns.biz':11200
- 'tr######host.servehttp.com':11200
- en#######nternet.fileave.com/BIN/Dllhost.EXE
- DNS ASK en#######nternet.fileave.com
- DNS ASK tr#####rhost.dyndns.biz
- DNS ASK tr######host.servehttp.com
- ClassName: 'Indicator' WindowName: ''