Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,"%APPDATA%\Microsoft\Windows\Start Menu\Programs\adobe.exe",'
- <File name>.exe
- %APPDATA%\microsoft\windows\start menu\programs\adobe.exe
- %TEMP%\<File name>.exe
- DNS ASK ya##o.com
- '%TEMP%\<File name>.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Test-Connection www.ya##o.com' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Test-Connection www.ya##o.com