Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinNT.exe' = '%APPDATA%\Windows Installer\WinNT.exe'
- winnt.exe
- %APPDATA%\windows installer\winnt.exe
- %APPDATA%\windows installer\winnt.exe
- DNS ASK my####oconnect.com
- '%APPDATA%\windows installer\winnt.exe' in
- '%APPDATA%\windows installer\winnt.exe'
- '%APPDATA%\windows installer\winnt.exe' in' (with hidden window)