Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows security.exe
- %APPDATA%\winlogon.exe
- %APPDATA%\winlogon.exe
- %APPDATA%\winlogon.exe
- http://www.so####recreator.net/winlogon.exe
- DNS ASK so####recreator.net
- '%APPDATA%\winlogon.exe'
- '%APPDATA%\microsoft\windows\start menu\programs\startup\windows security.exe'