Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'seattle' = '<Current directory>\windbyit.exe'
Infects the following executable files:
- C:\Far2\Plugins\FTP\lib\tmpdie7yu
- C:\Far2\Plugins\arclite\tmp8yx8i5
- <Auxiliary element>
- C:\Far2\Plugins\FTP\lib\tmp3ut7nh
- C:\Far2\Plugins\arclite\tmpli7htm
- C:\Far2\Plugins\arclite\tmpdlmxgw
- C:\Far2\Plugins\arclite\tmpqx4pkx
- C:\Far2\Plugins\arclite\tmpj9gg_w
Malicious functions:
Creates and executes the following:
- '<Current directory>\windbyit.exe'
Modifies file system :
Creates the following files:
- C:\Far2\Plugins\Compare\tmpo_p0gq
- C:\Far2\Plugins\Compare\tmpfzo0od
- C:\Far2\Plugins\Compare\tmpxgm03y
- C:\Far2\Plugins\Colorer\hrd\console\contrib\tmp__kq1s
- C:\Far2\Plugins\Compare\tmpeguau2
- C:\Far2\Plugins\Compare\tmpwvh7ju
- C:\Far2\Plugins\DrawLine\tmp1oqjff
- C:\Far2\Plugins\DrawLine\tmpyfqwd5
- C:\Far2\Plugins\DrawLine\tmptjug8f
- C:\Far2\Plugins\Compare\tmphrzf7x
- C:\Far2\Plugins\DrawLine\tmp8j6cii
- C:\Far2\Plugins\Colorer\hrd\console\tmptk0hwb
- C:\Far2\Plugins\Colorer\hrd\console\tmp9xv0dn
- C:\Far2\Plugins\Colorer\hrd\console\tmpwlcntu
- C:\Far2\Plugins\Colorer\hrd\console\tmpphd6fz
- C:\Far2\Plugins\Colorer\hrd\console\tmpmjpi1f
- C:\Far2\Plugins\Colorer\hrd\console\tmpjnybja
- C:\Far2\Plugins\Colorer\hrd\console\contrib\tmpyivrxe
- C:\Far2\Plugins\Colorer\hrd\console\contrib\tmps43hqe
- C:\Far2\Plugins\Colorer\hrd\console\contrib\tmpul7lqp
- C:\Far2\Plugins\Colorer\hrd\console\contrib\tmpkjztbh
- C:\Far2\Plugins\Colorer\hrd\console\contrib\tmph1vvai
- C:\Far2\Plugins\ExtSearch\tmpg8bzwm
- C:\Far2\Plugins\ExtSearch\tmpwgjaen
- C:\Far2\Plugins\EMenu\tmpgbdlfc
- C:\Far2\Plugins\EMenu\tmpcozmlm
- C:\Far2\Plugins\EMenu\tmpsnwbfk
- C:\Far2\Plugins\ExtSearch\tmp0vvrzc
- C:\Far2\Plugins\ExtSearch\doc\tmprp0tki
- C:\Far2\Plugins\ExtSearch\doc\tmpuq4qjz
- C:\Far2\Plugins\ExtSearch\doc\tmps2_oru
- C:\Far2\Plugins\ExtSearch\tmpfb7nmc
- C:\Far2\Plugins\ExtSearch\doc\tmpkltbcp
- C:\Far2\Plugins\EditCase\tmp6yxytp
- C:\Far2\Plugins\EditCase\tmpathy8f
- C:\Far2\Plugins\EditCase\tmpqsds05
- C:\Far2\Plugins\DrawLine\tmpakq43v
- C:\Far2\Plugins\DrawLine\tmp9dwbxv
- C:\Far2\Plugins\EditCase\tmplj5txb
- C:\Far2\Plugins\EMenu\tmpzyv40j
- C:\Far2\Plugins\EMenu\tmpgvn0m3
- C:\Far2\Plugins\EMenu\tmprt19pz
- C:\Far2\Plugins\EditCase\tmpvznibo
- C:\Far2\Plugins\EditCase\tmppio5mo
- C:\Far2\Plugins\Colorer\hrd\console\tmplbjcei
- C:\Far2\Plugins\Brackets\tmp6wkugx
- C:\Far2\Plugins\Colorer\tmpr3cwy1
- C:\Far2\Plugins\Brackets\tmpdc_y2m
- C:\Far2\Plugins\Brackets\tmpojnq9w
- C:\Far2\Plugins\Brackets\tmpqroyvt
- C:\Far2\Plugins\Colorer\tmplr51l_
- C:\Far2\Plugins\Colorer\bin\tmpqj4ebv
- C:\Far2\Plugins\Colorer\bin\tmpmdi43p
- C:\Far2\Plugins\Colorer\bin\tmplocqsq
- C:\Far2\Plugins\Colorer\tmpobhqna
- C:\Far2\Plugins\Colorer\bin\tmpdh9kpq
- C:\Far2\Plugins\arclite\tmp2gjjl9
- C:\Far2\Plugins\arclite\tmpmzkmqd
- C:\Far2\Plugins\arclite\tmptndhky
- C:\Far2\Plugins\arclite\tmpgagakg
- C:\Far2\Plugins\arclite\tmpfzvh9y
- C:\Far2\Plugins\AutoWrap\tmpobdsls
- C:\Far2\Plugins\Brackets\tmpg3zyxu
- C:\Far2\Plugins\Brackets\tmp100huw
- C:\Far2\Plugins\AutoWrap\tmpcwmds8
- C:\Far2\Plugins\AutoWrap\tmpj5ckwh
- C:\Far2\Plugins\AutoWrap\tmpkbktjn
- C:\Far2\Plugins\Colorer\hrc\auto\tmpod4b1i
- C:\Far2\Plugins\Colorer\hrc\auto\types\tmpc87lbv
- C:\Far2\Plugins\Colorer\hrc\auto\tmpjwtnk3
- C:\Far2\Plugins\Colorer\hrc\auto\tmpmcp95q
- C:\Far2\Plugins\Colorer\hrc\auto\tmp6ewcfx
- C:\Far2\Plugins\Colorer\hrd\tmplusybh
- C:\Far2\Plugins\Colorer\hrd\console\tmpoherwx
- C:\Far2\Plugins\Colorer\hrd\console\tmppdluqs
- C:\Far2\Plugins\Colorer\hrd\console\tmp7undn8
- C:\Far2\Plugins\Colorer\hrd\tmpw2poyu
- C:\Far2\Plugins\Colorer\hrd\tmpvk6aqc
- C:\Far2\Plugins\Colorer\hrc\tmpnz7cnl
- C:\Far2\Plugins\Colorer\hrc\tmptoodib
- C:\Far2\Plugins\Colorer\hrc\tmpk08gzm
- C:\Far2\Plugins\Colorer\hrc\tmpcawqyj
- C:\Far2\Plugins\Colorer\hrc\tmpq3qnze
- C:\Far2\Plugins\Colorer\hrc\tmpyvaepx
- C:\Far2\Plugins\Colorer\hrc\auto\tmpkaevab
- C:\Far2\Plugins\Colorer\hrc\auto\tmpqjfmtq
- C:\Far2\Plugins\Colorer\hrc\auto\tmphindo3
- C:\Far2\Plugins\Colorer\hrc\tmpob2ev_
- C:\Far2\Plugins\Colorer\hrc\auto\tmp82mwdn
- C:\Far2\Plugins\ProcList\tmphgwjd7
- C:\Far2\Plugins\ProcList\tmpgsz8x3
- C:\Far2\Plugins\ProcList\tmpw_p0kl
- C:\Far2\Plugins\Network\tmp6rrciw
- C:\Far2\Plugins\Network\tmpj6otqh
- C:\Far2\Plugins\ProcList\tmpvzkbao
- C:\Far2\Plugins\TmpPanel\tmpegylks
- C:\Far2\Plugins\TmpPanel\tmpi04sps
- C:\Far2\Plugins\TmpPanel\tmpaiokwb
- C:\Far2\Plugins\ProcList\tmp1nqppf
- C:\Far2\Plugins\ProcList\tmpzae1td
- C:\Far2\Plugins\MacroView\tmpg6fdsl
- C:\Far2\Plugins\MacroView\tmpvqb8b3
- C:\Far2\Plugins\MacroView\tmpnmoktv
- C:\Far2\Plugins\HlfViewer\tmpfdu7xy
- C:\Far2\Plugins\MacroView\tmp3b3hck
- C:\Far2\Plugins\MacroView\tmp0vek9a
- C:\Far2\Plugins\Network\tmp2xrifr
- C:\Far2\Plugins\Network\tmpanmob4
- C:\Far2\Plugins\Network\tmppwiheg
- C:\Far2\Plugins\MacroView\tmppmxxcm
- C:\Far2\Plugins\Network\tmppwygo2
- C:\Far2\PluginSDK\Headers.pas\tmptbdbwz
- C:\Far2\PluginSDK\Headers.pas\tmps9iiwi
- C:\Far2\PluginSDK\Headers.pas\tmpewbp0k
- C:\Far2\PluginSDK\Headers.c\tmpqn5fzt
- C:\Far2\PluginSDK\Headers.c\tmpauo_ug
- <Auxiliary element>
- %APPDATA%\Seatle202141\tmpdiph9p
- %APPDATA%\Seatle202141\l00000iiiiillll.blc
- %APPDATA%\Seatle202141\tmp_upwov
- %APPDATA%\Seatle202141\tmppw4odp
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\tmpqvtmv4
- C:\Far2\Plugins\TmpPanel\tmp1ybmun
- C:\Far2\Plugins\TmpPanel\tmpgondll
- C:\Far2\Plugins\TmpPanel\tmpsebysl
- C:\Far2\Plugins\TmpPanel\tmpxhpudm
- C:\Far2\Plugins\TmpPanel\tmpz2kqjm
- C:\Far2\Plugins\TmpPanel\tmpuquogq
- C:\Far2\Plugins\WinSCP\tmp2zq7ec
- C:\Far2\PluginSDK\Headers.c\tmparaphd
- C:\Far2\Plugins\WinSCP\tmpr7ayb3
- C:\Far2\Plugins\TmpPanel\tmpwym2nd
- C:\Far2\Plugins\WinSCP\tmpz5p0za
- C:\Far2\Plugins\HlfViewer\tmpopzz1b
- C:\Far2\Plugins\FarCmds\tmpj_kbjr
- C:\Far2\Plugins\FarCmds\tmphovkpx
- C:\Far2\Plugins\ExtSearch\sources\RegExp\tmpqwa0nx
- C:\Far2\Plugins\ExtSearch\sources\RegExp\tmp8j15ab
- C:\Far2\Plugins\ExtSearch\sources\RegExp\tmpi_fwbk
- C:\Far2\Plugins\FarCmds\tmpgwwy4j
- C:\Far2\Plugins\FileCase\tmpdddutm
- C:\Far2\Plugins\FileCase\tmplobts5
- C:\Far2\Plugins\FarCmds\tmppd_hii
- C:\Far2\Plugins\FarCmds\tmpvcwc5q
- C:\Far2\Plugins\FarCmds\tmp1x8hw7
- C:\Far2\Plugins\ExtSearch\sources\tmpbfrgfb
- C:\Far2\Plugins\ExtSearch\sources\tmpyo49lj
- C:\Far2\Plugins\ExtSearch\sources\tmplzr7jm
- C:\Far2\Plugins\ExtSearch\doc\tmpzwqds9
- C:\Far2\Plugins\ExtSearch\sources\tmpqhbsmo
- C:\Far2\Plugins\ExtSearch\sources\tmp72kblp
- C:\Far2\Plugins\ExtSearch\sources\tmpkz1ndp
- C:\Far2\Plugins\ExtSearch\sources\RegExp\tmpmoqcq_
- C:\Far2\Plugins\ExtSearch\sources\tmpwiuqla
- C:\Far2\Plugins\ExtSearch\sources\tmpyudjwn
- C:\Far2\Plugins\ExtSearch\sources\tmp5n8r3e
- C:\Far2\Plugins\FTP\lib\tmpdie7yu
- C:\Far2\Plugins\FTP\lib\tmpo9_h4d
- C:\Far2\Plugins\FTP\tmpq7244o
- C:\Far2\Plugins\FTP\tmppuzriv
- C:\Far2\Plugins\FTP\tmptid_wh
- C:\Far2\Plugins\FTP\lib\tmp3ut7nh
- C:\Far2\Plugins\HlfViewer\tmphbztyp
- C:\Far2\Plugins\HlfViewer\tmpo33tpq
- C:\Far2\Plugins\HlfViewer\tmpkh_k72
- C:\Far2\Plugins\FTP\lib\tmpv6pv2g
- C:\Far2\Plugins\HlfViewer\tmpkgd3ss
- C:\Far2\Plugins\FileCase\tmpi_iprc
- C:\Far2\Plugins\FTP\tmpy6q2oi
- C:\Far2\Plugins\FileCase\tmp4ajpry
- C:\Far2\Plugins\FileCase\tmpcatzm5
- C:\Far2\Plugins\FileCase\tmp7w3h16
- C:\Far2\Plugins\FTP\tmpfrykr6
- C:\Far2\Plugins\FTP\tmptgau4p
- C:\Far2\Plugins\FTP\tmpfzfhhe
- C:\Far2\Plugins\FTP\tmpj6d17e
- C:\Far2\Plugins\FTP\tmp7qblnx
- C:\Far2\Plugins\FTP\tmphgewf4
- C:\Far2\Plugins\arclite\tmpb8bysb
- C:\tmprysba5
- %APPDATA%\Seatle202141\tmpc8sqgb
- <Current directory>\libpangocairo-1.0-0.dll
- <Current directory>\libgtk-win32-2.0-0.dll
- <Current directory>\libpango-1.0-0.dll
- C:\tmp7nr2zj
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpqj1aty
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpbzurwe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\tmpfuuz0l
- C:\tmpkwjj8l
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\tmpn9lbee
- <Current directory>\libfontconfig-1.dll
- <Current directory>\libgdk_pixbuf-2.0-0.dll
- <Current directory>\libexpat-1.dll
- <Current directory>\libatk-1.0-0.dll
- <Current directory>\libcairo-2.dll
- <Current directory>\libgdk-win32-2.0-0.dll
- <Current directory>\libgobject-2.0-0.dll
- <Current directory>\libgthread-2.0-0.dll
- <Current directory>\libgmodule-2.0-0.dll
- <Current directory>\libgio-2.0-0.dll
- <Current directory>\libglib-2.0-0.dll
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\tmpw5neid
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\tmpyjbkrk
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\tmpjxaokr
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmprwzuyb
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpbz7yly
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\tmpzbcfcu
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\tmpgiuhiu
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\tmpdqmd73
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\tmpkvoa5j
- %ALLUSERSPROFILE%\DRM\tmpo33koe
- %ALLUSERSPROFILE%\DRM\tmpql69lw
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpxh7pyz
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmplp7v2p
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpd78coa
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpizvjqp
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpfufsxj
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpllmlwp
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpdpvagc
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpxq9foq
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpteyi13
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpr9jwti
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\tmpffjesj
- <Current directory>\intl.dll
- <Current directory>\step-1.png
- <Current directory>\step2-2.png
- <Current directory>\select.pyd
- <Current directory>\pywintypes27.dll
- <Current directory>\rugui.glade
- <Current directory>\step-3.png
- <Current directory>\win32api.pyd
- <Current directory>\win32com.shell.shell.pyd
- <Current directory>\wall.bmp
- <Current directory>\step-4.png
- <Current directory>\unicodedata.pyd
- <Current directory>\library.zip
- <Current directory>\msvcr90.dll
- <Current directory>\libpng14-14.dll
- <Current directory>\libpangoft2-1.0-0.dll
- <Current directory>\libpangowin32-1.0-0.dll
- <Current directory>\nextGD.png
- <Current directory>\python27.dll
- <Current directory>\pythoncom27.dll
- <Current directory>\pay.png
- <Current directory>\pango.pyd
- <Current directory>\pangocairo.pyd
- <Current directory>\favicon.png
- <Current directory>\final-step.png
- <Current directory>\Crypto.Cipher._AES.pyd
- <Current directory>\bz2.pyd
- <Current directory>\cairo._cairo.pyd
- <Current directory>\freetype6.dll
- <Current directory>\gobject._gobject.pyd
- <Current directory>\gtk._gtk.pyd
- <Current directory>\glib._glib.pyd
- <Current directory>\gdiplus.dll
- <Current directory>\gio._gio.pyd
- <Current directory>\windbyit.exe
- <Current directory>\zlib1.dll
- <Current directory>\win32wnet.pyd
- <Current directory>\win32file.pyd
- <Current directory>\win32gui.pyd
- <Current directory>\_ctypes.pyd
- <Current directory>\atk.pyd
- <Current directory>\back.png
- <Current directory>\_ssl.pyd
- <Current directory>\_hashlib.pyd
- <Current directory>\_socket.pyd
- C:\Far2\Addons\XLat\tmplxmmj7
- C:\Far2\Addons\XLat\Russian\tmpckq7za
- C:\Far2\Addons\Shell\tmp_7fqy_
- C:\Far2\Addons\SetUp\tmpqh9tkq
- C:\Far2\Addons\Shell\tmpr2p2sv
- C:\Far2\Documentation\eng\tmpa89jjm
- C:\Far2\Documentation\eng\tmpwsuexg
- C:\Far2\Documentation\eng\tmp4nubyv
- C:\Far2\Documentation\eng\tmp1zvym5
- C:\Far2\Documentation\eng\tmp3tgtg3
- C:\Far2\Documentation\eng\tmpdflmlp
- C:\Far2\tmp4tenie
- C:\Far2\tmpheirnf
- C:\Far2\tmpndm0r6
- C:\Far2\tmp5fdxdk
- C:\Far2\tmpjzqwsw
- C:\Far2\Addons\tmpfh17ga
- C:\Far2\Addons\Colors\Default Highlighting\tmpicwrwr
- C:\Far2\Addons\Macros\tmpuelplh
- C:\Far2\Addons\Colors\Custom Highlighting\tmpcs_tby
- C:\Far2\Addons\tmponyco5
- C:\Far2\Addons\Colors\tmptfrnl7
- C:\Far2\Plugins\Align\tmpwipvny
- C:\Far2\Plugins\Align\tmphosgwl
- C:\Far2\Plugins\Align\tmpfvxeuk
- C:\Far2\Plugins\7-Zip\tmp6eo5ip
- C:\Far2\Plugins\7-Zip\tmpl_0to6
- C:\Far2\Plugins\Align\tmpvoqzjf
- C:\Far2\Plugins\arclite\tmpqx4pkx
- C:\Far2\Plugins\arclite\tmp8yx8i5
- C:\Far2\Plugins\arclite\tmpj9gg_w
- C:\Far2\Plugins\arclite\tmpdlmxgw
- C:\Far2\Plugins\arclite\tmpli7htm
- C:\Far2\Documentation\rus\tmpph19je
- C:\Far2\Documentation\rus\tmp435bic
- C:\Far2\Documentation\rus\tmptfckzx
- C:\Far2\Documentation\rus\tmpzxhfvj
- C:\Far2\Documentation\rus\tmpuiczk8
- C:\Far2\Documentation\rus\tmpnats8z
- C:\Far2\Plugins\7-Zip\tmp49q0uq
- C:\Far2\Plugins\7-Zip\tmpkc1bpp
- C:\Far2\Plugins\7-Zip\tmptdgtkn
- C:\Far2\Encyclopedia\tmpep47hk
- C:\Far2\FExcept\tmpesu_j2
- C:\Far2\tmprcfnzn
- %HOMEPATH%\Favorites\tmpllmpwd
- %HOMEPATH%\Favorites\tmpjkza8b
- C:\Documents and Settings\Default User\Templates\tmpjjtqcj
- C:\Documents and Settings\Default User\Templates\tmpahw8gp
- C:\Documents and Settings\Default User\Templates\tmpwbqkqo
- %HOMEPATH%\Favorites\Links\tmpjfl0fx
- %HOMEPATH%\Favorites\Links\tmp_hawo1
- %HOMEPATH%\Templates\tmpyu8vix
- %HOMEPATH%\Favorites\Links\tmpqfo4ta
- %HOMEPATH%\Favorites\Links\tmpu5ds6b
- %HOMEPATH%\Favorites\Links\tmpqrahlw
- C:\Documents and Settings\Default User\Templates\tmpbi7jz6
- C:\Documents and Settings\Default User\Templates\tmpjpf0vd
- C:\Documents and Settings\Default User\Templates\tmpedv5v_
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\tmpug_jcg
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\tmp0qrdhs
- C:\Documents and Settings\Default User\Templates\tmp6gjlfc
- C:\Documents and Settings\Default User\Templates\tmpoistka
- C:\Documents and Settings\Default User\Templates\tmpq17wgs
- C:\Documents and Settings\Default User\Templates\tmpweo2vy
- C:\Documents and Settings\Default User\Templates\tmpgz6xe4
- C:\Documents and Settings\Default User\Templates\tmplscukk
- C:\Far2\tmpzvkjbh
- C:\Far2\tmpriyxtp
- C:\Far2\tmpw94zct
- C:\Far2\tmpxe18tq
- C:\Far2\tmpfdhfpq
- C:\Far2\tmpddciu0
- C:\Far2\tmpe4ylej
- C:\Far2\tmpzq1kuo
- C:\Far2\tmpnrrab7
- C:\Far2\tmpqxfcmk
- C:\Far2\tmp1nbcz2
- %HOMEPATH%\Templates\tmp0mb7kk
- %HOMEPATH%\Templates\tmpsm5qeu
- %HOMEPATH%\Templates\tmpzurjel
- %HOMEPATH%\Templates\tmpanvyte
- %HOMEPATH%\Templates\tmpxf0f5i
- %HOMEPATH%\Templates\tmpcbpqvv
- %HOMEPATH%\Templates\tmpea0m8j
- %HOMEPATH%\Templates\tmperh_hc
- %HOMEPATH%\Templates\tmp2tugpi
- %HOMEPATH%\Templates\tmpysr2tz
- %HOMEPATH%\Templates\tmpur26ye
Moves the following files:
- from %APPDATA%\Seatle202141\tmp_upwov to %APPDATA%\Seatle202141\fileorglistC.blc
- from %APPDATA%\Seatle202141\tmpdiph9p to %APPDATA%\Seatle202141\fileorglistZ.blc
- from <Current directory>\wall.bmp to %APPDATA%\wall.bmp
- from %APPDATA%\Seatle202141\tmpc8sqgb to %APPDATA%\Seatle202141\fileorglistC.blc
- from <Auxiliary element> to <Auxiliary element>
- from %APPDATA%\Seatle202141\tmppw4odp to %APPDATA%\Seatle202141\fileorglistC.blc
Network activity:
Connects to:
- 'lu##te.info':80
TCP:
HTTP POST requests:
- lu##te.info/random.php
UDP:
- DNS ASK lu##te.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
