Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'KB893803' = '%APPDATA%\KB893803\KB893803.pif'
- %APPDATA%\KB893803\KB893803.pif
- <SYSTEM32>\svchost.exe
- %WINDIR%\explorer.exe
- %APPDATA%\KB893803\KB893803.pif
- %APPDATA%\KB893803\KB893803.pif
- 'we##8582.in':80
- '11#.#11.111.8':80
- '11#.#11.111.4':80
- '11#.#11.111.2':80
- we##8582.in/index.php?r=#####
- 11#.#11.111.8/index.php?r=###
- we##8582.in/index.php?r=###
- DNS ASK we##8582.in
- '<Private IP address>':1036
- ClassName: 'Indicator' WindowName: ''