Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'YouPin' = '<SYSTEM32>\YouPin.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://xx#.#nxrbb.com/xz.html
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'OLLYDBG', WindowName: ''
- %WINDIR%\syswow64\youpin.exe
- DNS ASK xx#.#nxrbb.com
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://xx#.#nxrbb.com/xz.html' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3