Technical Information
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- %TEMP%\43oksoruizau\vuvtw.tmp
- %TEMP%\43oksoruizau\files_\system_info.txt
- %TEMP%\43oksoruizau\files_\screenshot.jpg
- %TEMP%\43oksoruizau\_files\_information.txt
- %TEMP%\43oksoruizau\_files\_screen_desktop.jpeg
- %TEMP%\43oksoruizau\files_\cookies\mozilla_firefox.txt
- %TEMP%\43oksoruizau\_files\_cookies\mozilla_firefox.txt
- %TEMP%\43oksoruizau\c5jmn.tmp-shm
- %TEMP%\43oksoruizau\files_\forms.txt
- %TEMP%\43oksoruizau\_files\_allforms_list.txt
- %TEMP%\43oksoruizau\fehs8.tmp
- %TEMP%\43oksoruizau\c5jmn.tmp
- %TEMP%\43oksoruizau\files_\cookies\opera.txt
- %TEMP%\43oksoruizau\_files\_cookies\opera.txt
- %TEMP%\43oksoruizau\vbwonxvdgrchp.zip
- %TEMP%\43oksoruizau\mkgp5z.tmp
- %TEMP%\43oksoruizau\7jyxx.tmp
- %TEMP%\43oksoruizau\files_\cookies.txt
- %TEMP%\43oksoruizau\_files\_allcookies_list.txt
- %TEMP%\43oksoruizau\files_\cookies\google_chrome.txt
- %TEMP%\43oksoruizau\_files\_cookies\google_chrome.txt
- %TEMP%\43oksoruizau\3yuuz0.tmp
- %TEMP%\43oksoruizau\uanpq7.tmp
- %TEMP%\43oksoruizau\wawsuz.tmp
- %TEMP%\43oksoruizau\84tw.tmp
- %TEMP%\43oksoruizau\esu1vs.tmp
- %TEMP%\43oksoruizau\sg7qns.tmp
- %TEMP%\43oksoruizau\eupeuh.tmp
- %TEMP%\43oksoruizau\hd6dok.tmp
- %TEMP%\43oksoruizau\gi3co.tmp
- %TEMP%\43oksoruizau\iv1nm5oyk5.zip
- %TEMP%\43oksoruizau\c5jmn.tmp-shm
- %TEMP%\43oksoruizau\vuvtw.tmp
- %TEMP%\43oksoruizau\uanpq7.tmp
- %TEMP%\43oksoruizau\sg7qns.tmp
- %TEMP%\43oksoruizau\mkgp5z.tmp
- %TEMP%\43oksoruizau\hd6dok.tmp
- %TEMP%\43oksoruizau\gi3co.tmp
- %TEMP%\43oksoruizau\files_\forms.txt
- %TEMP%\43oksoruizau\wawsuz.tmp
- %TEMP%\43oksoruizau\files_\cookies.txt
- %TEMP%\43oksoruizau\fehs8.tmp
- %TEMP%\43oksoruizau\eupeuh.tmp
- %TEMP%\43oksoruizau\esu1vs.tmp
- %TEMP%\43oksoruizau\c5jmn.tmp
- %TEMP%\43oksoruizau\84tw.tmp
- %TEMP%\43oksoruizau\7jyxx.tmp
- %TEMP%\43oksoruizau\3yuuz0.tmp
- %TEMP%\43oksoruizau\files_\cookies\opera.txt
- %TEMP%\43oksoruizau\_files\_cookies\opera.txt
- 'bi###yky02.top':80
- 'mo###ss01.top':80
- http://bi###yky02.top/index.php
- http://mo###ss01.top/index.php
- DNS ASK bi###yky02.top
- DNS ASK mo###ss01.top
- ClassName: '18467-41' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\43oKsORuIzau & timeout 2 & del /f /q "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\43oKsORuIzau & timeout 2 & del /f /q "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' 2