Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '"%APPDATA%\system\EJuSGBsJJrDq.exe",explorer.exe'
- '%TEMP%\Explorer.exe'
- '%TEMP%\AwesomeMinerKG.exe'
- Explorer.exe
- %APPDATA%\Imminent\Logs\13-11-2017
- %APPDATA%\Imminent\Monitoring\network.dat
- %APPDATA%\Imminent\Monitoring\system.dat
- %TEMP%\AwesomeMinerKG.exe
- %TEMP%\Explorer.exe
- %APPDATA%\system\EJuSGBsJJrDq.exe
- %APPDATA%\system\EJuSGBsJJrDq.exe
- 'sf.##mcb.com':80
- 'ga####ay.myvnc.com':9003
- 'wp#d':80
- 'crl.verisign.com':80
- http://crl.verisign.com/pca3-g5.crl
- http://sf.##mcb.com/sf.crl
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.verisign.com/pca3.crl
- DNS ASK sf.##mcb.com
- DNS ASK ga####ay.myvnc.com
- DNS ASK wp#d
- DNS ASK crl.verisign.com