Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mqkldrv' = '%APPDATA%\Microsoft\SDL\winlogon32.exe'
- '%APPDATA%\Microsoft\SDL\winlogon32.exe'
- %TEMP%\dplui.jpg
- %TEMP%\dplui.wav
- %APPDATA%\Microsoft\SDL\winlogon32.exe
- %APPDATA%\Microsoft\SDL\winnt32.img
- %APPDATA%\Microsoft\SDL\cygwin32.ocx
- %TEMP%\dplui.wav
- %TEMP%\dplui.wav.cr
- %APPDATA%\Microsoft\SDL\winlogon32.exe
- %TEMP%\dplui.jpg.cr
- %TEMP%\dplui.wav
- %TEMP%\dplui.jpg
- %APPDATA%\Microsoft\SDL\winlogon32.exe
- 'mv###.webege.com':80
- DNS ASK mv###.webege.com
- ClassName: 'Indicator' WindowName: '(null)'