Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'startupwln' = '%APPDATA%\startupwln\startupwin.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'startupwln' = '\startupwln\startupwin.exe'
- fsavaui.exe
- %APPDATA%\Imminent\Path.dat
- %APPDATA%\Imminent\Logs\28-12-2017
- C:\startupwln\startupwin.exe
- %TEMP%\<File name>\<File name>.exe
- %APPDATA%\startupwln\startupwin.exe
- %TEMP%\<File name>\<File name>.exe
- <Full path to file>
- '77.##.28.240':9003
- '%TEMP%\<File name>\<File name>.exe'
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 1000
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "<Full path to file>"