Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SharedAPPs' = '%WINDIR%\system\<File name>.exe'
- %WINDIR%\system\<File name>.exe
- %WINDIR%\system\sharedapp.reg
- <Current directory>\tmp
- %WINDIR%\inf\asynceql.inf
- %WINDIR%\system\sharedapp.reg
- %WINDIR%\system\sharedapp.reg
- 'go###e.com.br':80
- http://www.go###e.com.br/intl/pt-BR_br/images/logo.gif
- DNS ASK go###e.com.br
- DNS ASK vi####skynetx10.biz
- DNS ASK up###ath.com
- DNS ASK ne######evirtual24hs.biz
- ClassName: 'BestPlace' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- '%WINDIR%\syswow64\regedit.exe' /s %WINDIR%\system\sharedapp.reg' (with hidden window)
- '%WINDIR%\syswow64\regedit.exe' /s %WINDIR%\system\sharedapp.reg