Technical Information
- %HOMEPATH%\Start Menu\Programs\Startup\qbhcG5f9S7D0lKw1.exe.url
- %TEMP%\eafiyfhn.out
- %TEMP%\CSC3.tmp
- %TEMP%\eafiyfhn.0.cs
- %TEMP%\eafiyfhn.cmdline
- %TEMP%\dw.log
- %TEMP%\30570.dmp
- %TEMP%\RES4.tmp
- %TEMP%\eafiyfhn.dll
- %TEMP%\yb1wnxow.out
- %TEMP%\yb1wnxow.pdb
- %TEMP%\yb1wnxow.0.cs
- %TEMP%\yb1wnxow.cmdline
- %TEMP%\yb1wnxow.dll
- %HOMEPATH%\<File name>.exe
- %TEMP%\CSC1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\eafiyfhn.cmdline
- %TEMP%\CSC3.tmp
- %TEMP%\RES4.tmp
- %TEMP%\eafiyfhn.0.cs
- %TEMP%\eafiyfhn.dll
- %TEMP%\eafiyfhn.out
- %TEMP%\yb1wnxow.0.cs
- %TEMP%\yb1wnxow.pdb
- %TEMP%\CSC1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\yb1wnxow.cmdline
- %TEMP%\yb1wnxow.out
- %TEMP%\yb1wnxow.dll
- 'jo######rsen.strangled.net':10130
- 'ra######.chickenkiller.com':10130
- DNS ASK Jo######rsen.strangled.net
- DNS ASK Ra######.chickenkiller.com
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\CSC3.tmp"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 748
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\eafiyfhn.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\yb1wnxow.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"