Technical Information
- <SYSTEM32>\tasks\active
- C:\users\public\pictures\35227\act.exe
- C:\users\public\videos\lsp.exe
- C:\users\public\pictures\35227\ttvip.exe
- C:\users\public\pictures\35227\libcef.dll
- C:\users\public\pictures\35227\act.exe
- C:\users\public\videos\lsp.exe
- from C:\users\public\pictures\35227\act.exe to %TEMP%\1177277\....\temporaryfile
- from <Full path to file> to %TEMP%\_@f787.tmp
- '2.###aamm.com':83
- '11##.#elegramh.net':1121
- http://2.####amm.com:83/lsp/act.ocx via 2.###aamm.com
- http://2.####amm.com:83/lsp/1121.ocx via 2.###aamm.com
- http://2.####amm.com:83/lsp/aa.ocx via 2.###aamm.com
- http://2.####amm.com:83/lsp/libcef.dll via 2.###aamm.com
- DNS ASK 2.###aamm.com
- DNS ASK 11##.#elegramh.net
- 'C:\users\public\pictures\35227\act.exe' 6 23321 fds01234fs56789123afds
- 'C:\users\public\videos\lsp.exe'
- 'C:\users\public\pictures\35227\act.exe' 6 23321 fds01234fs56789123afds' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONLOGON /TN active /F /RL HIGHEST /TR C:\Users\Public\Pictures\35227\ttvip.exe' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONLOGON /TN active /F /RL HIGHEST /TR C:\Users\Public\Pictures\35227\ttvip.exe