Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\.Net CLR] 'Start' = '00000002'
- <Current directory>\sxe3.tmp
- <SYSTEM32>\svchost.exe -k ".Net CLR"
- <Current directory>\sxe3.tmp
- <SYSTEM32>\360fd.dll
- <Current directory>\sxe2.tmp
- <Current directory>\sxe1.tmp
- <Current directory>\sxe3.tmp
- <Current directory>\sxe1.tmp
- <Current directory>\sxe2.tmp
- 'localhost':2009