Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MyPlayusers1' = '%PROGRAM_FILES%\Internet Explorer\bindingcopy.exe'
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\winlogon.exe
- %PROGRAM_FILES%\Internet Explorer\temp0406.exe
- <SYSTEM32>\cmd.exe /c mybat.bat
- <Current directory>\mybat.bat
- %PROGRAM_FILES%\Internet Explorer\temp0406.exe
- %PROGRAM_FILES%\Internet Explorer\bindingcopy.exe
- 's.##8fa.net':406
- DNS ASK s.##8fa.net
- '<Private IP address>':1037
- ClassName: '' WindowName: 'goii20345903seroipor'