Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinData.exe' = '%ALLUSERSPROFILE%\WinData.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'crypted' = '%APPDATA%\crypted.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\crypted.exe
- <SYSTEM32>\tasks\crypted
- %ALLUSERSPROFILE%\windata.exe
- %TEMP%\crypted.exe
- %APPDATA%\crypted.exe
- 'ip##pi.com':80
- http://ip##pi.com/line/?fi############
- DNS ASK ip##pi.com
- DNS ASK mo#####iser.ddns.net
- '%ALLUSERSPROFILE%\windata.exe'
- '%TEMP%\crypted.exe'
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "crypted" /tr "%APPDATA%\crypted.exe"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "crypted" /tr "%APPDATA%\crypted.exe"