Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\WinNetAuthIntManSvc] 'ImagePath' = '<SYSTEM32>\wnaims.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinNetAuthIntManSvc] 'Start' = '00000002'
- '<SYSTEM32>\wnaims.exe'
- '<SYSTEM32>\sc.exe' start WinNetAuthIntManSvc
- '<SYSTEM32>\wnaims.exe' /install /silent
- <SYSTEM32>\wnaims.exe
- '10#.#1.195.65':80
- '45.##.243.211':80
- http://45.##.243.211/sexylist.txt
- http://45.##.243.211/b662ef49.txt
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''