Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup Key' = '%TEMP%\wininit.exe'
- '' (downloaded from the Internet)
- %TEMP%\wininit.exe
- %TEMP%\EBYtSKHSjxTHQojMOuPUcSxHHGLhovanmDGJBZoh.exe
- %TEMP%\EBYtSKHSjxTHQojMOuPUcSxHHGLhovanmDGJBZoh.exe
- 'rg#o.st':80
- 'wp#d':80
- http://rg#o.st/download/7zfxRQJvp/f35f148996ae5c889ba8fd5ff22d9210d32ba22e/Top.exe
- http://11#.#11.111.1/wpad.dat via wp#d
- DNS ASK rg#o.st
- DNS ASK wp#d
- '%TEMP%\EBYtSKHSjxTHQojMOuPUcSxHHGLhovanmDGJBZoh.exe'