Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '240c339' = '%APPDATA%\240c339.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '240c33' = 'C:\240c339\240c339.exe'
- %HOMEPATH%\Start Menu\Programs\Startup\240c339.exe
- System Restore (SR)
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
- <SYSTEM32>\svchost.exe
- %APPDATA%\240c339.exe
- C:\240c339\240c339.exe
- 'do#####anabestplace.com':80
- DNS ASK do#####anabestplace.com
- ClassName: 'Indicator' WindowName: '(null)'