Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'startup32' = '%LOCALAPPDATA%\startup32.exe'
- %LOCALAPPDATA%\startup32.exe
- %LOCALAPPDATA%\startup32.exe
- http://www.bi###alin.com/
- http://www.go###e.com.tr/
- DNS ASK bi###alin.com
- DNS ASK go###e.com.tr
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%LOCALAPPDATA%\startup32.exe'
- '%LOCALAPPDATA%\startup32.exe' ' (with hidden window)