Technical Information
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- %TEMP%\nsw77fd.tmp\uac.dll
- %PROGRAMDATA%\mphkxheccuznptma\files\_screen.jpg
- %PROGRAMDATA%\mphkxheccuznptma\notfbxkj.zip
- %APPDATA%\rgfwedwsax.exe
- %APPDATA%\ergfeefvg.exe
- %PROGRAMDATA%\7okrxk7j8yg\files\passwords_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\forms_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\cc_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\cookies_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\moz_cookies.db
- %PROGRAMDATA%\7okrxk7j8yg\files\cookies\mozillafirefox_zd7wpa3.txt
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %PROGRAMDATA%\7okrxk7j8yg\moz_forms.db
- %PROGRAMDATA%\7okrxk7j8yg\files\cookies\mozillafirefox_barjlim.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\information.txt
- %PROGRAMDATA%\7okrxk7j8yg\1723651.txt
- %PROGRAMDATA%\7okrxk7j8yg\43561237n.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\screensh0t.jpg
- %PROGRAMDATA%\7okrxk7j8yg\nl___2020_04_09___18_39___ckpuvu2tsihfrbj6g6.zip
- %PROGRAMDATA%\mimflmw\fjchsuw.bat
- %TEMP%\tgrfedc.txt
- %PROGRAMDATA%\mphkxheccuznptma\files\_filepasswords.txt
- %PROGRAMDATA%\7okrxk7j8yg\moz_cookies.db-shm
- %PROGRAMDATA%\mphkxheccuznptma\172773668.txt
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %ProgramFiles(x86)%\inb\spok\bin\chpokchik.exe
- %ProgramFiles(x86)%\inb\spok\bin\sijhgfv.exe
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\_filepasswords.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\_fileforms.txt
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\_filecc.txt
- %APPDATA%\opera software\opera stable\webdatacopy
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\_filecookies.txt
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\mphkxheccuznptma\mocc.db
- %PROGRAMDATA%\mphkxheccuznptma\mocc.db-shm
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\cookies\mozilla_firefox_cookies_dsjtjmp.txt
- %PROGRAMDATA%\mphkxheccuznptma\moff.db
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\cookies\mozilla_firefox_cookies_yrmgohs.txt
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\mphkxheccuznptma\files\_info.txt
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\7okrxk7j8yg\moz_cookies.db
- %PROGRAMDATA%\7okrxk7j8yg\1723651.txt
- %PROGRAMDATA%\7okrxk7j8yg\moz_cookies.db-shm
- %PROGRAMDATA%\7okrxk7j8yg\files\cookies_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\cc_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\forms_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\passwords_list.txt
- %ProgramFiles(x86)%\inb\spok\bin\chpokchik.exe
- %PROGRAMDATA%\mphkxheccuznptma\notfbxkj.zip
- %PROGRAMDATA%\7okrxk7j8yg\moz_forms.db
- %PROGRAMDATA%\mphkxheccuznptma\moff.db
- %PROGRAMDATA%\mphkxheccuznptma\files\_screen.jpg
- %PROGRAMDATA%\mphkxheccuznptma\files\_info.txt
- %PROGRAMDATA%\mphkxheccuznptma\mocc.db-shm
- %APPDATA%\opera software\opera stable\cookiescopy
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %APPDATA%\opera software\opera stable\webdatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\_filecc.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %PROGRAMDATA%\mphkxheccuznptma\mocc.db
- %APPDATA%\rgfwedwsax.exe
- %PROGRAMDATA%\mphkxheccuznptma\files\browsers\_filecc.txt
- %PROGRAMDATA%\mphkxheccuznptma\mocc.db-shm
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\7okrxk7j8yg\files\passwords_list.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\7okrxk7j8yg\files\forms_list.txt
- %PROGRAMDATA%\7okrxk7j8yg\files\cc_list.txt
- %APPDATA%\opera software\opera stable\webdatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %PROGRAMDATA%\7okrxk7j8yg\files\cookies_list.txt
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\7okrxk7j8yg\moz_cookies.db-shm
- http://ip##pi.com/line
- http://jj###d06.top/download.php?fi########
- http://jj###d06.top/downfiles/3.exe
- http://jj###d06.top/downfiles/6.exe
- http://ip##pi.com/line/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://mi###r04.top/index.php
- http://st##f01.top/index.php
- DNS ASK ip##pi.com
- DNS ASK mi###r04.top
- DNS ASK jj###d06.top
- DNS ASK st##f01.top
- DNS ASK ip###ger.org
- DNS ASK 2n#.co
- DNS ASK sc########-o-matic-affiliate.com
- ClassName: '18467-41' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '%ProgramFiles(x86)%\Inb\spok\bin\sijhgfv.exe'
- '%ProgramFiles(x86)%\inb\spok\bin\chpokchik.exe'
- '%ProgramFiles(x86)%\inb\spok\bin\sijhgfv.exe'
- '%APPDATA%\rgfwedwsax.exe'
- '%APPDATA%\ergfeefvg.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\mPHkXHeCcuZNptMa & timeout 1 & del /f /q "%ProgramFiles(x86)%\Inb\spok\bin\chpokchik.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\7OKrXk7J8yG & timeout 1 & del /f /q "%APPDATA%\rgfwedwsax.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\mPHkXHeCcuZNptMa & timeout 1 & del /f /q "%ProgramFiles(x86)%\Inb\spok\bin\chpokchik.exe"
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\7OKrXk7J8yG & timeout 1 & del /f /q "%APPDATA%\rgfwedwsax.exe"