Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'NySis' = 'C:\TwIji\NySis.exe'
- <Full path to virus>
- 'ge#####.boletoempresa.com':80
- ge#####.boletoempresa.com/
- DNS ASK ge#####.boletoempresa.com
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'TabWindowClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Frame Tab' WindowName: ''