Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
- %WINDIR%\syswow64\config\mullertrans.bat
- %WINDIR%\syswow64\config\muliertrans.exe
- %WINDIR%\syswow64\config\mlliotrans.pps
- DNS ASK pu###2011.com
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- '%WINDIR%\syswow64\config\muliertrans.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\config\MullerTrans.bat" "
- '%ProgramFiles%\microsoft office\office14\powerpnt.exe' /s "<SYSTEM32>\config\Mlliotrans.pps"