Technical Information
- %TEMP%\u1ak.0.exe
- %TEMP%\u1ak.0.exe
- '18#.#72.128.90':80
- '18#.#72.128.65':80
- '18#.#72.128.144':80
- '18#.#72.128.209':80
- http://18#.#72.128.90/cpa/ping.php?su###################
- http://18#.#72.128.65/ping.php?su########
- http://18#.#72.128.65/syncUpd.exe
- http://18#.#72.128.209/15f649199f40275b/sqlite3.dll
- '%TEMP%\u1ak.0.exe'
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\u1ak.0.exe" & del "%ALLUSERSPROFILE%\*.dll"" & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\u1ak.0.exe" & del "%ALLUSERSPROFILE%\*.dll"" & exit
- '%WINDIR%\syswow64\timeout.exe' /t 5