Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Copies itself to
- C:\Windows\System32\searchhost.exe
- Creates services
- HKLM\System\CurrentControlSet\services\searchhost
- Modifies several reg entries in:
- HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\
- HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
- C2 traffic tcp 8080, 443, 80, and 4143
Advertisement
Add Comment
Please, Sign In to add comment
