Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\Microsoft\svchost.exe'
- %HOMEPATH%\Start Menu\Programs\Startup\svchost.exe
- <Current directory>:{48006200-4700-5200-5700-530032004500}
- <Current directory>:{61005100-7700-5400-6800-570054005700}
- %ALLUSERSPROFILE%\Application Data\Isolated Storage\{61005100-7700-5400-6800-570054005700}
- %APPDATA%\Microsoft\svchost.exe
- %TEMP%\mlt.tmp
- %APPDATA%\Microsoft:{48006200-4700-5200-5700-530032004500}
- %ALLUSERSPROFILE%\Application Data\Isolated Storage\{48006200-4700-5200-5700-530032004500}
- %APPDATA%\Microsoft:{61005100-7700-5400-6800-570054005700}
- %APPDATA%\Microsoft\svchost.exe
- %TEMP%\mlt.tmp
- 'jo#####yne13.ddns.net':5000
- DNS ASK jo#####yne13.ddns.net
- ClassName: 'Shell_traywnd' WindowName: ''
- '%APPDATA%\Microsoft\svchost.exe'