Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe "%APPDATA%\cmgbtalsyh2sjhbti1mjatsmos1q3vf2\csrss.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Full path to file>' = '<Full path to file>:*:Enabled:ldrsoft'
- from <Full path to file> to %APPDATA%\cmgbtalsyh2sjhbti1mjatsmos1q3vf\csrss.exe
- 'm0##.com':80
- http://87.#5.44.12/forum.php?v=##################################################################### via m0##.com
- DNS ASK m0##.com