Technical Information
- %HOMEPATH%\documents\b9ajma.exe
- %HOMEPATH%\documents\etoken.dll
- %HOMEPATH%\documents\perfi.db
- %HOMEPATH%\documents\cache.dat
- %WINDIR%\temp\aceprocted.sys
- %HOMEPATH%\documents\b9ajma.exe
- %HOMEPATH%\documents\etoken.dll
- %HOMEPATH%\documents\perfi.db
- %HOMEPATH%\documents\cache.dat
- 'r8####.###-cn-beijing.aliyuncs.com':443
- 'r8####.###-cn-beijing.aliyuncs.com':443
- DNS ASK r8####.###-cn-beijing.aliyuncs.com
- '%HOMEPATH%\documents\b9ajma.exe'
- '<SYSTEM32>\taskeng.exe' {D9088E1A-FCB2-4A0A-872A-A77D02629AB8} S-1-5-21-3691498038-2086406363-2140527554-1000:bzdilwcrbx\user:Interactive:[1]
- '%HOMEPATH%\documents\b9ajma.exe' ' (with hidden window)