Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%WINDIR%\system\Winlogon.exe'
- C:\command.sys
- %WINDIR%\system\winlogon.exe
- %WINDIR%\system\interop.netfwtypelib.dll
- 'po####.interia.pl':587
- DNS ASK po####.interia.pl
- '%WINDIR%\system\winlogon.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\system\winlogon.exe"