Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f_33' = 'rundll32.exe "%APPDATA%\ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f_33.avi", start'
- <SYSTEM32>\rundll32.exe ""%TEMP%\ins1.tmp"", start update worker
- %APPDATA%\ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f_33.avi
- %TEMP%\ins1.tmp
- '91.#88.60.5':80
- 91.#88.60.5/hit.php?v=####################################################################
- ClassName: 'Indicator' WindowName: ''