Technical Information
- %WINDIR%\explorer.exe
- firefox.exe
- iexplore.exe process, wininet.dll module
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
- %APPDATA%\microsoft\windows\start menu\programs\sonma-t\hpctkir.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
- 'of##ec.cf':80
- http://of##ec.cf/n/Qeebdln_Kufnwdwx.bmp
- DNS ASK of##ec.cf
- '%WINDIR%\syswow64\cmd.exe' /c timeout 2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout 2
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '%WINDIR%\syswow64\colorcpl.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"