Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'scrss' = '%APPDATA%\dotNET.lnk'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Wininit' = 'C:\Sysdll32.lnk'
- %APPDATA%\microsoft\windows\start menu\programs\startup\dotnet.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\sysdll32.lnk
- %PROGRAMDATA%\dcrat.exe
- %PROGRAMDATA%\upd.exe
- %APPDATA%\svchost.exe
- %APPDATA%\dotnet.lnk
- C:\svchost.exe
- C:\sysdll32.lnk
- '5.##8.60.80':80
- ClassName: 'EDIT' WindowName: ''
- '%PROGRAMDATA%\upd.exe'
- '%PROGRAMDATA%\dcrat.exe'
- '%APPDATA%\svchost.exe'
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher