Technical Information
- %WINDIR%\W33.exe (downloaded from the Internet)
- %WINDIR%\W22.exe (downloaded from the Internet)
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\W33[1].jpg
- %WINDIR%\W22.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\W22[1].jpg
- %WINDIR%\W44.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\W44[1].jpg
- %WINDIR%\W33.jpg
- %APPDATA%\DYA_WHJEMWFJHEIUOQDFK\1.0.0\Data\dya.dat
- %ALLUSERSPROFILE%\Application Data\DYA_WHJEMWFJHEIUOQDFK\1.0.0\Data\updates.dat
- %ALLUSERSPROFILE%\Application Data\DYA_WHJEMWFJHEIUOQDFK\1.0.0\Data\app.dat
- %WINDIR%\Wpps.pps
- %ALLUSERSPROFILE%\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFRWGTV105L8YNFXWHKH9XVP6HNPFSVF7JB4VP4GF
- %ALLUSERSPROFILE%\Application Data\DYA_WHJEMWFJHEIUOQDFK\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFRWGTV105L8YNFXWHKH9XVP6HNPFSVF7JB4VP4GF
- 'www.sn###rive.net':80
- 'localhost':1035
- www.sn###rive.net/files/565525/W44.jpg
- www.sn###rive.net/files/565525/W33.jpg
- www.sn###rive.net/files/565525/W22.jpg
- DNS ASK www.sn###rive.net
- '<Private IP address>':1036