Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'init' = '%windir%\temp\system\winit.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'init' = '%windir%\temp\system\winit.exe'
- %WINDIR%\temp\system\s.reg
- %WINDIR%\temp\system\msvcp100d.dll
- %WINDIR%\temp\system\msvcr100d.dll
- %WINDIR%\temp\system\wininit.exe
- %WINDIR%\temp\system\winit.exe
- %TEMP%\7zsfx000.cmd
- %TEMP%\7zsfx000.cmd
- DNS ASK ir###.iownyour.biz
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- '%WINDIR%\temp\system\winit.exe'
- '%WINDIR%\temp\system\wininit.exe' irc-1.iownyour.biz 6667 r0b0tz5739
- '%WINDIR%\temp\system\wininit.exe' irc-1.iownyour.biz 6667 r0b0tz5739' (with hidden window)
- '%WINDIR%\syswow64\regedit.exe' /s s.reg' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (with hidden window)
- '%WINDIR%\syswow64\regedit.exe' /s s.reg
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "