Technical Information
- %WINDIR%\tasks\clockshock.job
- [<HKLM>\System\CurrentControlSet\Services\Enlightened Communication] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Enlightened Communication] 'ImagePath' = '%APPDATA%\Enlightened Communication\Enlightened Communication.exe'
- %APPDATA%\enlightened communication\enlightened communication.exe
- %ALLUSERSPROFILE%\application data\{67190cc1-10d0-85a9-6719-90cc110d3304}\<File name>.exe
- %APPDATA%\enlightened communication\juy.dat
- %ALLUSERSPROFILE%\application data\{67190cc1-10d0-85a9-6719-90cc110d3304}\<File name>.dat
- DNS ASK fu###et.info
- DNS ASK al####el-pro.com
- DNS ASK fu###set.work
- DNS ASK gr###model.biz
- '%APPDATA%\enlightened communication\enlightened communication.exe'