Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'gjv5gu8t9r4et' = '%TEMP%\1.tmp\WinsidebarV2.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ygfzjnabeahvf' = 'e:\WinsidebarV2.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jf2vpsf2kbd985' = 'c:\temp\WinsidebarV2.exe'
- <Drive name for removable media>:\WinsidebarV2.exe
- '%TEMP%\1.tmp\WinsidebarV2.exe'
- '<Drive name for removable media>:\WinsidebarV2.exe'
- 'C:\temp\WinsidebarV2.exe'
- '<SYSTEM32>\notepad.exe' %TEMP%\1.tmp\1.Harry_potter_And_The_Sorcerer's_Stone.txt
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\last.bat" "
- %TEMP%\1.tmp\1.Harry_potter_And_The_Sorcerer's_Stone.txt
- C:\temp\WinsidebarV2.exe
- %TEMP%\1.tmp\last.bat
- %TEMP%\1.tmp\WinsidebarV2.exe
- %TEMP%\1.tmp\last.bat
- %TEMP%\1.tmp\1.Harry_potter_And_The_Sorcerer's_Stone.txt
- %TEMP%\1.tmp\WinsidebarV2.exe
- 'www.ex#####ngthewmscog.com':80
- DNS ASK www.ex#####ngthewmscog.com
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'