Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PlayTorrent' = '%APPDATA%\PlayerMedia\wmti.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\hookmgr] 'ImagePath' = '<Current directory>\hookmgr.sys'
- <Current directory>\hookmgr.sys
- %TEMP%\roxer.dll
- <Current directory>\hookmgr.sys
- '<LOCALNET>.0.2':445
- 'ma#####n.if-medped.org':80
- http://ma#####n.if-medped.org/media/point.php
- DNS ASK ma#####n.if-medped.org