Technical Information
- <SYSTEM32>\at.exe 17:57 /every:3,6,9,12,15,18,21,24,27,30 "<SYSTEM32>\powercfgg.exe"
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\google[1]
- <SYSTEM32>\powercfgg.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\indeh[1].php
- %TEMP%\2315212282.tmp
- %TEMP%\219314170.tmp
- %TEMP%\2849213550.bin
- %TEMP%\2027721699.bin
- %TEMP%\2849213550.bin
- %TEMP%\2315212282.tmp
- %TEMP%\219314170.tmp
- 'kw###ame.com':80
- '74.##5.232.51':80
- 'localhost':1036
- kw###ame.com/indeh.php?u=########################################
- 74.##5.232.51/
- DNS ASK kw###ame.com
- DNS ASK google.com
- ClassName: 'Shell_TrayWnd' WindowName: ''