Technical Information
- <SYSTEM32>\tasks\teva9
- %HOMEPATH%\documents\yzagrn.exe
- %HOMEPATH%\documents\vselog.dll
- %HOMEPATH%\documents\wordpadfilter.db
- %HOMEPATH%\documents\msmplist.dat
- <DRIVERS>\189atohci.sys
- %HOMEPATH%\documents\yzagrn.exe
- %HOMEPATH%\documents\vselog.dll
- %HOMEPATH%\documents\wordpadfilter.db
- %HOMEPATH%\documents\msmplist.dat
- 'ss####.###-cn-hangzhou.aliyuncs.com':443
- 'ss####.###-cn-hangzhou.aliyuncs.com':443
- DNS ASK ss####.###-cn-hangzhou.aliyuncs.com
- '%HOMEPATH%\documents\yzagrn.exe'
- '<SYSTEM32>\taskeng.exe' {788162A9-73B4-41D5-ACBA-9C11D9C10E2B} S-1-5-21-3691498038-2086406363-2140527554-1000:cqohlfllb\user:Interactive:[1]
- '%HOMEPATH%\documents\yzagrn.exe' ' (with hidden window)