Technical Information
- %WINDIR%\tasks\bookkeep.job
- %ALLUSERSPROFILE%\application data\{05ea5d7f-3d31-a398-05ea-a5d7f3d375fc}\<File name>.exe
- %ALLUSERSPROFILE%\application data\{05ea5d7f-3d31-a398-05ea-a5d7f3d375fc}\<File name>.dat
- DNS ASK ri###ynorth.biz
- DNS ASK al####el-pro.com
- DNS ASK pa###tmodel.biz
- DNS ASK ce####-ring.info