Technical Information
- [HKLM\software\Wow6432Node\microsoft\windows\CurrentVersion\Run] 'Therecontinuous ' = '%WINDIR%\DNomb\PTvrst.exe'
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- %WINDIR%\dnomb\spolsvt.exe
- %WINDIR%\dnomb\ptvrst.exe
- C:\users\public\documents\123\ptvrst.exe
- 'ha####.###-cn-hongkong.aliyuncs.com':80
- http://ha####.###-cn-hongkong.aliyuncs.com/ssqq/PTvrst.png
- DNS ASK ha####.###-cn-hongkong.aliyuncs.com
- ClassName: 'CabinetWClass' WindowName: '123'
- ClassName: 'CabinetWClass' WindowName: 'C:\Users\Public\Documents\123\'
- ClassName: 'CabinetWClass' WindowName: 'C:\Users\Public\Documents\123'
- ClassName: '' WindowName: ''
- ClassName: 'DirectUIHWND' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- 'C:\users\public\documents\123\ptvrst.exe'