Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'rechnung.exe' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\rechnung.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\rechnung.exe
- '5.###.148.130':1337
- '5.###.148.130':6604
- '%APPDATA%\microsoft\windows\start menu\programs\startup\rechnung.exe'