Technical Information
- <SYSTEM32>\tasks\microsoft\windows\microsoftmail
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllhost.exe
- %ProgramFiles%\windows nt\arphadump64.exe
- %ProgramFiles%\windows nt\arphadump64.dll
- %ProgramFiles%\windows nt\arphadump64.bin
- 'ba##u.com':80
- '45.##4.213.148':7777
- DNS ASK ba##u.com
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\svchost.exe' -k netsvcs' (with hidden window)