Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\edqkn9u3mij92y.lnk
- %APPDATA%\ihzxyokdpxphv\oyrgqdbx1xr.exe
- %APPDATA%\3qauqllcmbz27y.vbs
- 'drive.google.com':443
- 'pk#.goog':80
- http://pk#.goog/gsr1/gsr1.crt
- 'drive.google.com':443
- DNS ASK drive.google.com
- DNS ASK pk#.goog
- '%WINDIR%\syswow64\wscript.exe' %APPDATA%\3QAUQLLCMBZ27Y.vbs
- '%WINDIR%\syswow64\wscript.exe' %APPDATA%\3QAUQLLCMBZ27Y.vbs' (with hidden window)