Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = 'userinit.exe,%WINDIR%\svchost32.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'svchost32' = '%WINDIR%\svchost32.exe'
- %WINDIR%\explorer.exe
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %TEMP%\software.exe
- %WINDIR%\hacked_1b4deec0\serverlogs\user\18-05-2020
- from %TEMP%\software.exe to %WINDIR%\svchost32.exe
- from %WINDIR%\svchost32.exe to %WINDIR%\svchost32.exe
- DNS ASK ha####.no-ip.org
- '%TEMP%\software.exe'
- '%WINDIR%\svchost32.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'