Technical Information
- '<SYSTEM32>\taskkill.exe' /f /im Icloud.exe
- %TEMP%\7ZipSfx.000\iclouds.cmd
- %TEMP%\7ZipSfx.000\IcloudSecurity.lnk
- %TEMP%\7ZipSfx.000\ipad.system
- %TEMP%\7ZipSfx.000\error.vbs
- %HOMEPATH%\IcloudSecurity\Icloud.exe
- %TEMP%\7ZipSfx.001\icloud.cmd
- %TEMP%\7ZipSfx.001\Iclouding.exe
- %TEMP%\7ZipSfx.001\job.txt
- ClassName: '' WindowName: ''
- '%HOMEPATH%\IcloudSecurity\Icloud.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\7ZipSfx.000\error.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\iclouds.cmd" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.001\icloud.cmd" "
- '<SYSTEM32>\cmd.exe' /c vol c:
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
- '<SYSTEM32>\reg.exe' Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
- '<SYSTEM32>\find.exe' /I "ProxyServer"