Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\smartclock.lnk
- <SYSTEM32>\tasks\smart clock
- %WINDIR%\syswow64\timeout.exe
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- ClassName: 'OLLYDBG', WindowName: ''
- %PROGRAMDATA%\yth\ivm21_protected.exe
- %PROGRAMDATA%\hyaqqebrcvw\maa.db
- %PROGRAMDATA%\hyaqqebrcvw\mac.db
- %PROGRAMDATA%\hyaqqebrcvw\mac.db-shm
- %PROGRAMDATA%\hyaqqebrcvw\files_\cookies\mozilla_firefox.txt
- %PROGRAMDATA%\scjcxmp\_files\_screen_desktop.jpeg
- %PROGRAMDATA%\scjcxmp\_files\_information.txt
- %PROGRAMDATA%\scjcxmp\vqb3gvv4to.zip
- %PROGRAMDATA%\hyaqqebrcvw\files_\screenshot.jpg
- %PROGRAMDATA%\scjcxmp\maa.db
- %PROGRAMDATA%\hyaqqebrcvw\files_\system_info.txt
- %APPDATA%\rhgtdfs.exe
- %APPDATA%\ndfsr.exe
- %APPDATA%\smart clock\smartclock.exe
- %TEMP%\tythedc.txt
- %PROGRAMDATA%\sfwpaet\8372422.txt
- %PROGRAMDATA%\sfwpaet\files\_information.txt
- %PROGRAMDATA%\sfwpaet\46173476.txt
- %PROGRAMDATA%\sfwpaet\nl_2020_06_17___15_40___kpeewa_95.211.190.199.zip
- %PROGRAMDATA%\hyaqqebrcvw\files_\cookies.txt
- %PROGRAMDATA%\hyaqqebrcvw\files_\cookies\opera.txt
- %PROGRAMDATA%\hyaqqebrcvw\files_\cookies\google_chrome.txt
- %APPDATA%\opera software\opera stable\web datam
- %APPDATA%\opera software\opera stable\cookiesm
- %LOCALAPPDATA%\google\chrome\user data\default\login dataf
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesf
- %LOCALAPPDATA%\google\chrome\user data\default\web dataf
- %APPDATA%\opera software\opera stable\login dataf
- %APPDATA%\opera software\opera stable\cookiesf
- %APPDATA%\opera software\opera stable\web dataf
- %PROGRAMDATA%\scjcxmp\_files\_cookies\google_chrome.txt
- %PROGRAMDATA%\scjcxmp\_files\_allcookies_list.txt
- %TEMP%\rfdc.txt
- %PROGRAMDATA%\hyaqqebrcvw\1qheytwshakg.zip
- %PROGRAMDATA%\scjcxmp\_files\_cookies\opera.txt
- %PROGRAMDATA%\scjcxmp\mac.db-shm
- %PROGRAMDATA%\scjcxmp\_files\_cookies\mozilla_firefox.txt
- %PROGRAMDATA%\yth\ivm22_protected.exe
- %PROGRAMDATA%\hyaqqebrcvw\c133gbqcp.txt
- %LOCALAPPDATA%\google\chrome\user data\default\login datam
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesm
- %LOCALAPPDATA%\google\chrome\user data\default\web datam
- %APPDATA%\opera software\opera stable\login datam
- %PROGRAMDATA%\scjcxmp\0rfylgm.txt
- %PROGRAMDATA%\scjcxmp\mac.db
- %APPDATA%\kgjtrjcm.exe
- %LOCALAPPDATA%\google\chrome\user data\default\login dataf
- %PROGRAMDATA%\sfwpaet\46173476.txt
- %PROGRAMDATA%\yth\ivm22_protected.exe
- %PROGRAMDATA%\yth\ivm21_protected.exe
- %PROGRAMDATA%\hyaqqebrcvw\mac.db
- %PROGRAMDATA%\hyaqqebrcvw\maa.db
- %PROGRAMDATA%\hyaqqebrcvw\files_\cookies.txt
- %PROGRAMDATA%\hyaqqebrcvw\files_\cookies\opera.txt
- %PROGRAMDATA%\scjcxmp\_files\_cookies\opera.txt
- %PROGRAMDATA%\scjcxmp\mac.db
- %PROGRAMDATA%\scjcxmp\maa.db
- %PROGRAMDATA%\scjcxmp\0rfylgm.txt
- %PROGRAMDATA%\sfwpaet\8372422.txt
- %PROGRAMDATA%\hyaqqebrcvw\mac.db-shm
- %APPDATA%\opera software\opera stable\cookiesm
- %APPDATA%\opera software\opera stable\login datam
- %LOCALAPPDATA%\google\chrome\user data\default\web datam
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesm
- %LOCALAPPDATA%\google\chrome\user data\default\login datam
- %PROGRAMDATA%\scjcxmp\mac.db-shm
- %APPDATA%\opera software\opera stable\web dataf
- %APPDATA%\opera software\opera stable\cookiesf
- %APPDATA%\opera software\opera stable\login dataf
- %LOCALAPPDATA%\google\chrome\user data\default\web dataf
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesf
- %APPDATA%\opera software\opera stable\web datam
- %APPDATA%\rhgtdfs.exe
- %LOCALAPPDATA%\google\chrome\user data\default\login dataf
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesf
- %LOCALAPPDATA%\google\chrome\user data\default\web dataf
- %APPDATA%\opera software\opera stable\login dataf
- %APPDATA%\opera software\opera stable\cookiesf
- %APPDATA%\opera software\opera stable\web dataf
- %LOCALAPPDATA%\google\chrome\user data\default\login datam
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesm
- %LOCALAPPDATA%\google\chrome\user data\default\web datam
- %APPDATA%\opera software\opera stable\login datam
- %APPDATA%\opera software\opera stable\cookiesm
- %APPDATA%\opera software\opera stable\web datam
- http://ip##pi.com/line
- http://rr###ad07.top/download.php?fi########
- http://rr###ad07.top/downfiles/6.exe
- http://rr###ad07.top/downfiles/4.exe
- http://ip##pi.com/line/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://bl###head.top/downloads/Preststp.exe
- http://re##e02.top/index.php
- http://tw##s04.top/index.php
- DNS ASK ip##pi.com
- DNS ASK ip###ger.org
- DNS ASK re##e02.top
- DNS ASK tw##s04.top
- DNS ASK rr###ad07.top
- DNS ASK microsoft.com
- DNS ASK 2n#.co
- DNS ASK sc########-o-matic-affiliate.com
- DNS ASK bl###head.top
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
- '%PROGRAMDATA%\yth\ivm21_protected.exe'
- '%PROGRAMDATA%\yth\ivm22_protected.exe'
- '%APPDATA%\rhgtdfs.exe'
- '%APPDATA%\ndfsr.exe'
- '%APPDATA%\smart clock\smartclock.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\scjCxmp & timeout 2 & del /f /q "%PROGRAMDATA%\yth\ivm21_protected.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\hyaQqeBRcVw & timeout 3 & del /f /q "%PROGRAMDATA%\yth\ivm22_protected.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\sfwpaet & timeout 2 & del /f /q "%APPDATA%\rhgtdfs.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\scjCxmp & timeout 2 & del /f /q "%PROGRAMDATA%\yth\ivm21_protected.exe"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\hyaQqeBRcVw & timeout 3 & del /f /q "%PROGRAMDATA%\yth\ivm22_protected.exe"
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\timeout.exe' 3
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\sfwpaet & timeout 2 & del /f /q "%APPDATA%\rhgtdfs.exe"