Technical Information
- %TEMP%\gkhrydecgw.js
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023091420230915\index.dat
- %TEMP%\gkhrydecgw.js
- 'ad##t.oo.lv':80
- 'pa#####.#ooglesyndication.com':443
- 'se##.25u.com':80
- http://ad##t.oo.lv/ldr/j3_2.php?s=
- http://se##.25u.com/ldr/j3_2.php?s=
- http://ad##t.oo.lv/favicon.ico
- 'pa#####.#ooglesyndication.com':443
- DNS ASK ad##t.oo.lv
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK se##.25u.com
- DNS ASK fi##.#ervequake.com
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\syswow64\wscript.exe' //B "%TEMP%\gkhRydecGw.js" "<Full path to file>"
- '%WINDIR%\syswow64\wscript.exe' //B "%TEMP%\gkhRydecGw.js" "<Full path to file>"' (with hidden window)