Technical Information
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\downswapy
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\winperf\ariefknacn89i194a7ok.exe
- <Current directory>\gxrire3dsq
- <Current directory>\dbex8r0mjx
- <Current directory>\3ux1wi6mkt
- <Current directory>\tlz79zs5k5
- <Current directory>\pktt5cjjpu
- <Current directory>\ytl7ewa0mt
- <Current directory>\ird8w2mgyi
- <Current directory>\94cnhsad5t
- <Current directory>\zx7pfaz2dm
- <Current directory>\zbtbxyrv6d
- <Current directory>\v642uutncw
- <Current directory>\om4evmlrgi
- <Current directory>\thlbzsbph1
- <Current directory>\hdee2klfa8
- <Current directory>\mxrzjgufzd
- <Current directory>\z8h2s0nbr5
- <Current directory>\vaav4wogxh
- <Current directory>\q74oog4t25
- <Current directory>\6vddbifmlc
- <Current directory>\wjoenwww5m
- <Current directory>\cnsswbdtnl
- <Current directory>\63jv9zwh3v
- <Current directory>\0bvvkqtabb
- <Current directory>\uhypdscvr9
- <Current directory>\n9ecajol9y
- <Current directory>\dn7nmo6uuy
- <Current directory>\w4qn8p5jwg
- <Current directory>\rvfkwh6xpz
- <Current directory>\9jrq6yladm
- %APPDATA%\winperf\94miemopod8ppdeskdlxoen5rma3mg.bat
- %APPDATA%\winperf\xsani4qgnmcyak5zjmejsheaqjkqxk.bat
- %APPDATA%\winperf\downswapy.exe
- %APPDATA%\winperf\vyndqtgweks9hx0ijzpkzt7fw7vfq8.vbe
- C:\perflogs\admin\iexplore.exe
- %TEMP%\4b64654a844494ae8a678a34941db990
- %ProgramFiles(x86)%\msbuild\microsoft\dwm.exe
- C:\perflogs\admin\svchost.exe
- C:\msocache\all users\lsass.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\packages\debugger\winlogon.exe
- C:\totalcmd\language\smss.exe
- <Current directory>\eli9gda2ex
- <Current directory>\dvmb4mjbcr
- <Current directory>\downswapy.exe
- <Current directory>\uvrdi3mupm
- <Current directory>\nvnefi6cpb
- <Current directory>\xzgrx4e4bb
- <Current directory>\c8hbu95hjm
- <Current directory>\66eajznonj
- <Current directory>\2eadfupzpn
- <Current directory>\yrsnkpylkg
- <Current directory>\nytdeavfi8
- <Current directory>\raq2j87dg9
- <Current directory>\tf26xoobz4
- <Current directory>\abehgdu78e
- %APPDATA%\winperf\o9bpkacmu53ddquvcy9ouwbi2v7orh.vbs
- <Current directory>\krjsrzhqf2
- <Current directory>\apcjwa2hhf
- <Current directory>\om4evmlrgi
- <Current directory>\94cnhsad5t
- <Current directory>\zx7pfaz2dm
- <Current directory>\zbtbxyrv6d
- <Current directory>\v642uutncw
- <Current directory>\thlbzsbph1
- <Current directory>\dvmb4mjbcr
- <Current directory>\hdee2klfa8
- <Current directory>\ytl7ewa0mt
- <Current directory>\ird8w2mgyi
- <Current directory>\mxrzjgufzd
- <Current directory>\q74oog4t25
- <Current directory>\6vddbifmlc
- <Current directory>\wjoenwww5m
- <Current directory>\cnsswbdtnl
- <Current directory>\63jv9zwh3v
- <Current directory>\0bvvkqtabb
- <Current directory>\uhypdscvr9
- <Current directory>\z8h2s0nbr5
- <Current directory>\vaav4wogxh
- <Current directory>\pktt5cjjpu
- <Current directory>\tlz79zs5k5
- <Current directory>\3ux1wi6mkt
- <Current directory>\uvrdi3mupm
- <Current directory>\nvnefi6cpb
- <Current directory>\xzgrx4e4bb
- <Current directory>\c8hbu95hjm
- <Current directory>\66eajznonj
- <Current directory>\2eadfupzpn
- <Current directory>\yrsnkpylkg
- <Current directory>\nytdeavfi8
- <Current directory>\krjsrzhqf2
- <Current directory>\raq2j87dg9
- <Current directory>\abehgdu78e
- <Current directory>\9jrq6yladm
- <Current directory>\rvfkwh6xpz
- <Current directory>\w4qn8p5jwg
- <Current directory>\n9ecajol9y
- <Current directory>\dn7nmo6uuy
- <Current directory>\gxrire3dsq
- <Current directory>\dbex8r0mjx
- <Current directory>\tf26xoobz4
- <Current directory>\eli9gda2ex
- <Current directory>\apcjwa2hhf
- http://18#.#20.249.212/wrlk9s52rlnyuch9i8kh8bzax9g3fw1y6h1pwv7p5jtvnxt6ohilbm0u6qu359vdwe0imqqqet6ra0x174ylzf4y/54w1htd5snhc9bbi491f90xg8zsf2l/220e9c9680ea922ea1b9fa5155de3ad62bcaf07d.php?4d###...
- http://18#.#20.249.212/wrlk9s52rlnyuch9i8kh8bzax9g3fw1y6h1pwv7p5jtvnxt6ohilbm0u6qu359vdwe0imqqqet6ra0x174ylzf4y/54w1htd5snhc9bbi491f90xg8zsf2l/220e9c9680ea922ea1b9fa5155de3ad62bcaf07d.php?2b###...
- http://18#.#20.249.212/wrlk9s52rlnyuch9i8kh8bzax9g3fw1y6h1pwv7p5jtvnxt6ohilbm0u6qu359vdwe0imqqqet6ra0x174ylzf4y/54w1htd5snhc9bbi491f90xg8zsf2l/3jgnhx9smjezbsfvuzo5envtm7nqj8a8/0e8fb847918e4228f...
- DNS ASK ip##fo.io
- ClassName: 'EDIT' WindowName: ''
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\winperf\o9BpkaCMu53DDQuvcy9oUwbi2v7orH.vbs"
- '%APPDATA%\winperf\ariefknacn89i194a7ok.exe' -pf0d0dd7f6ebcfebef8377ad27a7484582c5f5b88
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\winperf\VyNDqTGweKs9HX0IJzPkZT7Fw7vFQ8.vbe"
- '%APPDATA%\winperf\downswapy.exe'
- '<Current directory>\downswapy.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\94mIEmOpOD8pPDeSKDlXOEn5RMA3Mg.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\XSani4qGNMCyak5ZjmeJsheAqjKqXK.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\94mIEmOpOD8pPDeSKDlXOEn5RMA3Mg.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\XSani4qGNMCyak5ZjmeJsheAqjKqXK.bat" "
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\PerfLogs\Admin\iexplore.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\dwm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\svchost.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\winlogon.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "downswapy" /sc ONLOGON /tr "'<Current directory>\downswapy.exe'" /rl HIGHEST /f