Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\drg40k9ye6fnsm.lnk
- <SYSTEM32>\csrss.exe
- %TEMP%\content\3440-3212-wscript.exe-23-37-54-730.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-679.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-678.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-677.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-676.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-675.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-117.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-116.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-18-115.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-17-288.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-17-287.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-17-286.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-17-279.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-399.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-20-110.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-20-109.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-396.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-395.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-394.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-285.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-164.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-609.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-608.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-607.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-603.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-489.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-475.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-376.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-14-278.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-398.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-07-774.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-20-111.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-49-876.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-49-826.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-49-780.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-49-074.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-47-945.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-26-545.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-26-542.dump
- %APPDATA%\whritebegingoldsx.zip
- %TEMP%\content\376-2264-wscript.exe-23-38-26-446.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-25-050.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-24-833.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-24-832.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-663.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-662.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-661.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-660.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-659.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-658.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-657.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-656.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-655.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-654.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-645.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-087.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-22-086.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-21-469.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-21-468.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-21-467.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-20-980.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-13-926.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-15-397.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-13-925.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-13-924.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-990.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-05-513.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-875.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-874.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-873.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-836.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-812.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-728.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-533.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-532.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-472.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-471.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-304.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-05-940.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-05-939.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-05-512.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-07-730.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-05-511.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-05-462.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-05-461.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-04-658.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-04-657.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-04-656.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-04-655.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-04-646.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-04-562.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-04-503.dump
- %TEMP%\content\3440-3212-wscript.exe-23-37-58-295.dump
- %LOCALAPPDATA%\meampacerchaonlhdwumsnu9okubfvnq\d4jbrz5kt52gg0v1hh1vaniyadhb.wsf
- %LOCALAPPDATA%\wiatrace.log
- %TEMP%\content\376-2264-wscript.exe-23-38-52-079.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-20-979.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-07-773.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-07-888.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-06-876.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-989.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-988.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-987.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-986.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-985.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-984.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-983.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-11-982.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-10-997.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-10-996.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-10-995.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-10-994.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-774.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-773.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-772.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-771.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-770.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-769.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-558.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-09-335.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-08-986.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-08-985.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-08-568.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-08-567.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-08-566.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-08-425.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-07-890.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-07-889.dump
- %TEMP%\content\376-2264-wscript.exe-23-38-07-853.dump
- %TEMP%\content\3440-3212-wscript.exe-23-39-18-095.dump
- http://63.##0.42.87/Fkgkatztvviogp/Aianbkzlukkwuyfi/Rfgybqhbokpl/Drfxigsqkiauxr/whritebegingoldsx.db
- http://63.##0.42.64/up_list_ld.php?1=##############################################################################################
- http://63.##0.42.64/img-sys/server_misconfigured.png
- http://63.##0.42.64/img-sys/powered_by_cpanel.svg
- DNS ASK go.microsoft.com
- DNS ASK settings-win.data.microsoft.com
- DNS ASK share.microsoft.com
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\mEAmPacercHAOnLHDwumsnu9oKubFvNQ\D4jbRz5kt52gG0V1hh1vANiYadhb.wsf"
- '%ProgramFiles(x86)%\internet explorer\ielowutil.exe' -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
- '%ProgramFiles%\internet explorer\iexplore.exe' -Embedding
- '<SYSTEM32>\devicecensus.exe' UserCxt