Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'vedheftnin' = '%HOMEPATH%\Lilerkner\Middelsign8.vbs'
- lfya.exe
- %HOMEPATH%\lfya.exe
- %HOMEPATH%\lilerkner\middelsign8.exe
- %HOMEPATH%\lilerkner\middelsign8.vbs
- 'ar##els.com':443
- DNS ASK ar##els.com
- '%HOMEPATH%\lfya.exe'
- '%HOMEPATH%\lilerkner\middelsign8.exe'