Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ApplicationFrameHost.exe' = '"%HOMEPATH%\ApplicationFrameHost.exe.exe"'
- ghijkl nopqrstu wxy.exe
- %HOMEPATH%\applicationframehost.exe.exe
- %APPDATA%\ghijkl nopqrstu wxy\ghijkl nopqrstu wxy.exe
- %APPDATA%\ghijkl nopqrstu wxy\ghijkl nopqrstu wxy.exe.lnk
- aeuli
- %APPDATA%\ghijkl nopqrstu wxy\ghijkl nopqrstu wxy.exe
- %APPDATA%\ghijkl nopqrstu wxy\ghijkl nopqrstu wxy.exe.lnk
- 'sk###.0pe.kr':1005
- DNS ASK sk###.0pe.kr
- DNS ASK gy#.#yddos.com
- '%APPDATA%\ghijkl nopqrstu wxy\ghijkl nopqrstu wxy.exe'
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul