Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\launch.exe
- firefox.exe
- %TEMP%\_ddl1n6f.0.vb
- %TEMP%\_ddl1n6f.cmdline
- %TEMP%\_ddl1n6f.out
- %TEMP%\vbc6042.tmp
- %TEMP%\res6053.tmp
- %TEMP%\date.ini
- %TEMP%\res6053.tmp
- %TEMP%\vbc6042.tmp
- %TEMP%\_ddl1n6f.out
- %TEMP%\_ddl1n6f.0.vb
- %TEMP%\_ddl1n6f.cmdline
- from <Full path to file> to %TEMP%\updater.exe
- http://he####corp.free.fr/
- DNS ASK he####corp.free.fr
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_ddl1n6f.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6053.tmp" "%TEMP%\vbc6042.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_ddl1n6f.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6053.tmp" "%TEMP%\vbc6042.tmp"