Technical Information
- <SYSTEM32>\tasks\firefox default browser agent 9c92a26dedbead6e
- %APPDATA%\giadafr
- %TEMP%\2ce9.exe
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite-shm
- %APPDATA%\giadafr
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite-shm
- %TEMP%\2ce9.exe
- 'ho####ile-host6.com':80
- 'an###iles.com':443
- '19#.#33.8.122':80
- 'tr##sfer.sh':443
- 'fi######ter-cluster-1.com':80
- 'pf##p.com':443
- http://fi######ter-cluster-1.com/1.exe
- http://ho####ile-host6.com/
- 'an###iles.com':443
- 'tr##sfer.sh':443
- 'pf##p.com':443
- DNS ASK ho####ile-host6.com
- DNS ASK an###iles.com
- DNS ASK tr##sfer.sh
- DNS ASK fi######ter-cluster-1.com
- DNS ASK pf##p.com
- '%TEMP%\2ce9.exe'
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 0 &Del %TEMP%\2CE9.exe
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 0