Technical Information
- %TEMP%\user2.txt
- %APPDATA%\fdc5042f\ak.tmp
- %TEMP%\user7
- %TEMP%\user8
- %APPDATA%\userv3.4.2.2.vbs
- %APPDATA%\userv3.4.2.2.txt
- %TEMP%\user2.txt
- %TEMP%\user7
- %TEMP%\user8
- %TEMP%\user7
- %TEMP%\user8
- 'as###.no-ip.org':25565
- DNS ASK as###.no-ip.org
- '%WINDIR%\syswow64\cscript.exe' "%APPDATA%\userv3.4.2.2.vbs"
- '%WINDIR%\syswow64\cscript.exe' "%APPDATA%\userv3.4.2.2.vbs"' (with hidden window)