Technical Information
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %APPDATA%\offthewal\filingood.exe
- %APPDATA%\offthewal\testoviyjuki.exe
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://of###ewall.top/brazi/filingood.exe
- http://of###ewall.top/brazi/testoviyjuki.exe
- http://he##za.icu/IRemotePanel
- DNS ASK ip###ger.org
- DNS ASK of###ewall.top
- DNS ASK 8f##.thifink.ru
- DNS ASK he##za.icu
- DNS ASK ap#.ip.sb
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
- '%APPDATA%\offthewal\filingood.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'