Technical Information
- <SYSTEM32>\tasks\distributed
- %APPDATA%\microsoft\windows\start menu\programs\startup\techblend.lnk
- '<SYSTEM32>\at.exe' /3ihjshdf8734692903490
- %TEMP%\ixp000.tmp\ho.a3x
- %TEMP%\ixp000.tmp\autoit3.exe
- %LOCALAPPDATA%\innoblend dynamics\v.a3x
- %LOCALAPPDATA%\innoblend dynamics\autoit3.exe
- %LOCALAPPDATA%\innoblend dynamics\techblend.vbs
- DNS ASK He#####IGHb.HemorkYIGHb
- DNS ASK microsoft.com
- '%TEMP%\ixp000.tmp\autoit3.exe' Ho.a3x
- '<SYSTEM32>\at.exe' /3ihjshdf8734692903490' (with hidden window)
- '%TEMP%\ixp000.tmp\autoit3.exe' Ho.a3x' (with hidden window)