Technical Information
- [<HKLM>\System\CurrentControlSet\Control\Print\Providers\11ab2b] 'Name' = '%TEMP%\A830.tmp'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Security Protection' = '%ALLUSERSPROFILE%\defender.exe'
- iexplore.exe
- firefox.exe
- %TEMP%\a830.tmp
- %ALLUSERSPROFILE%\defender
- C:\users\public\desktop\security protection.lnk
- from %ALLUSERSPROFILE%\defender to %ALLUSERSPROFILE%\defender.exe
- 'so####ssecrets.com':80
- http://so####ssecrets.com/video/s.php?id####
- DNS ASK ya##inx.com
- DNS ASK so####ssecrets.com
- DNS ASK so####download.com
- '%ALLUSERSPROFILE%\defender.exe'