Technical Information
Modifies file system
Creates the following files
- %TEMP%\nsb1f8c.tmp
- %TEMP%\userguide_9233.pdf
- %TEMP%\settings_3109.dat
- %TEMP%\readme_7150.txt
- %TEMP%\nst247f.tmp\logex.dll
- %TEMP%\log.txt
- %TEMP%\nst247f.tmp\nsjson.dll
- %TEMP%\aff.conf
- %TEMP%\nst247f.tmp\nsrandom.dll
- %TEMP%\nst247f.tmp\nsisdl.dll
Deletes the following files
- %TEMP%\nst247f.tmp\logex.dll
- %TEMP%\nst247f.tmp\nsisdl.dll
- %TEMP%\nst247f.tmp\nsjson.dll
- %TEMP%\nst247f.tmp\nsrandom.dll
Network activity
TCP
HTTP GET requests
- http://tr###.#ackupgrid.net/?pa#########################################################
- http://li##.#ypcbackup.com/none/download_ppi/none?in################################
- http://cd#.##ckupgrid.net/MyPCBackup_ppi_Setup.exe
UDP
- DNS ASK tr###.#ackupgrid.net
- DNS ASK li##.#ypcbackup.com
- DNS ASK cd#.##ckupgrid.net
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
