Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '11f86284' = '%APPDATA%\ZWinXWD\winxwd.exe'
- '%APPDATA%\ZWinXWD\winxwd.exe'
- '<SYSTEM32>\cmd.exe' /v/c (set f="<Full path to file>"&for /l %l in () do if exist !f! (del /f/a !f!) else (exit))
- winxwd.exe
- %APPDATA%\ZWinXWD\winxwd.exe
- 'sy####rarealty.com':80
- 'll######yncaravanpark.co.uk':80
- 'www.ya###ashop.com':80
- http://sy####rarealty.com/wp-content/plugins/WPSecurity/load.php
- http://ll######yncaravanpark.co.uk/wp-content/plugins/WPSecurity/load.php
- http://www.ya###ashop.com/wp-content/plugins/WPSecurity/load.php
- DNS ASK sy####rarealty.com
- DNS ASK ll######yncaravanpark.co.uk
- DNS ASK www.ya###ashop.com