Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft OneDrive В® Temp' = '%LOCALAPPDATA%\FlashPlayer\otuboxeqeg\Z6s2.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft OneDrive В®' = '%LOCALAPPDATA%\FlashPlayer\otuboxeqeg\Z6s2.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft OneDrive В®' = '%HOMEPATH%\Documents\FlashPlayer\otuboxeqeg\B8q9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\] 'NoChangeStartMenu' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\] 'NoClose' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\] 'NoLogOff' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\] 'NoRun' = '00000000'
- firefox.exe
- %LOCALAPPDATA%\flashplayer\otuboxeqeg\z6s2.exe
- %HOMEPATH%\documents\flashplayer\otuboxeqeg\b8q9.exe
- %LOCALAPPDATA%\Google\Chrome\User Data\Local State
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\prefs.js
- 'ip##pi.com':80
- http://ip##pi.com/json/
- DNS ASK ip##pi.com
- ClassName: 'Button' WindowName: ''